CoderAIProvider: disable or flag a provider when its Secret stops allowing the provider's origin #267

The CoderAIProvider controller (dormant, #154) must disable an enabled provider in Coder, or clearly flag it, when the key Secret's coder.com/credential-destinations annotation stops allowing the origin of the provider's base URL in Coder.

Current behavior

A Ready, enabled provider keeps its last applied state when the destinations annotation is narrowed. The reconcile stalls with CredentialDestinationNotAllowed and sends nothing, so Coder keeps the provider enabled and keeps sending the key to that origin.

Required behavior

When the annotation no longer allows the origin that Coder uses:

• If the controller created the provider (its ID is in status), it disables the provider in Coder with a PATCH that sends no key and no URL, and reports a stalled condition that says so. Or it reports a condition that clearly states that Coder still sends the key there. The fix PR picks one and justifies it.
• A test: an enabled, Ready provider whose Secret drops its origin ends disabled in Coder, or with that condition, and the key appears in no status, log or error.

Tracking

• This is plan row A5b in the AI providers, chat models and AI policies as controller CRDs #154 stack. It is a hard gate for the first activation PR (A7), next to 🤖 CoderControlPlane: use the operator token Secret only when the control plane owns it #227, 🤖 Apply the cross-origin redirect check to the license and aggregated Coder clients #236 and credentialsecret: refuse a control plane's license and database Secrets #249.
• Found by the final assessment of 🤖 feat: create the Coder provider for a CoderAIProvider #253.

Refs #154

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high