credentialsecret: refuse a control plane's license and database Secrets #249

The shared credential Secret check (internal/credentialsecret) refuses a Secret that is a control plane's operator token Secret. Plan S1 for #154 also requires it to refuse a control plane's license Secret and database Secret.

Today an admin must still add the opt-in label and a destinations annotation before such a Secret is usable, so this is defense in depth, not an open path.

Scope

1. credentialsecret refuses Secrets named as a CoderControlPlane's license Secret or database Secret in the same namespace.
2. The control plane watch mapping re-queues dependents when those names change.
3. The change applies to every caller of the shared contract (CoderWorkspaceProxy, CoderProvisioner, CoderAIProvider), with tests for each.
4. Docs name the new refusal.

Gate

This must land before the #154 activation PR (A7) and before any other AI CRD stack activates.

Found during final assessment of #245.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium