CoderAIProvider activation follow-ups (#154) #321

Follow-ups from the CoderAIProvider activation (#312 delete path, #315 activation). Refs #154. None of them blocks activation.

• GitOps health rules. Add the Argo CD Lua rule and the Flux healthCheckExprs entry for CoderAIProvider in config/gitops/, with health_test.go coverage and a section in docs/how-to/gitops.md. Plan row A7 lists them; this follows the 🤖 feat: activate the CoderTemplateTest controller #210 → 🤖 docs: add GitOps health rules for CoderTemplateTest #212 order.
• Reason after an operator disable. After the credential kill switch disables a provider and the Secret is repaired, the reason reads DisabledExternally ("was disabled in Coder"), although the operator disabled it. The re-enable path (a spec edit) is correct; only the wording misleads. Seen in the Kind dogfood on 🤖 feat: activate the CoderAIProvider controller #315.
• ENABLED column. kubectl get coderaiproviders prints spec.enabled, so a refused object that does not exist in Coder shows ENABLED true. Consider a status-based column.
• Plan test S9. No test compares the secrets rule in config/rbac/role.yaml with a golden copy. 🤖 feat: activate the CoderAIProvider controller #315 does not change that rule (checked by diff), but the gate has no automated check.
• Re-check the YAML seeding facts on a Coder bump. internal/controller/coderaiprovider_env.go pins the v2.37.3 facts (only bedrock_base_url and bedrock_region seed anthropic from a config file). A Coder version that adds YAML keys for providers or legacy keys needs a new check.

Not tracked here: envFrom inspection stays a documented limit (maintainer decision on #310). Kind phases P1 to P4 are plan row A8, the next PR.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high