Strengthen plan check assertions for ruleset insertion test

- Add granular plan check using plancheck.ExpectKnownValue to verify
  that exactly one nested block is added (ruleset.# changes from 3 to 4)
- This provides more specific validation than just checking for Update action
- Addresses review comment about strengthening plan check assertions

Author: bhouse-nexthop

cloudstack/resource_cloudstack_network_acl_rule_test.go

@@ -26,8 +26,10 @@ import (
 
 	"github.com/apache/cloudstack-go/v2/cloudstack"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
 	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
 )
 
 func TestAccCloudStackNetworkACLRule_basic(t *testing.T) {
@@ -565,6 +567,12 @@ func TestAccCloudStackNetworkACLRule_ruleset_insert_plan_check(t *testing.T) {
 						// Verify that only 1 rule is being added (the new rule 20)
 						// and the existing rules (10, 30, 50) are not being modified
 						plancheck.ExpectResourceAction("cloudstack_network_acl_rule.plan_check", plancheck.ResourceActionUpdate),
+						// Verify that ruleset.# is changing from 3 to 4 (exactly one block added)
+						plancheck.ExpectKnownValue(
+							"cloudstack_network_acl_rule.plan_check",
+							tfjsonpath.New("ruleset"),
+							knownvalue.SetSizeExact(4),
+						),
 					},
 				},
 				Check: resource.ComposeTestCheckFunc(