CoderAIProvider: a confirmed create adopts a key changed in the dashboard before the confirming read #332

Summary

A lost create answer, followed by a key change in the Coder dashboard before the confirming read, is adopted silently. The CoderAIProvider then reports Ready while Coder holds a key that the operator did not send.

Details

1. createAIProvider writes the create marker and the Secret's change token into status.credential, then sends the create.
2. The create commits in Coder, but the answer is lost (a timeout or reset), so the object waits with ConfirmingCreate and reads Coder about 5 s later.
3. If an owner changes the provider key in the dashboard inside that window, recordAIProvider (internal/controller/coderaiprovider_create.go:120-132) records the one key ID it finds as this object's key.
4. The change token still matches the Secret, so syncAIProvider sends no key and marks the object Ready.

Impact: Coder keeps the dashboard key. This needs an owner's dashboard action inside a seconds-long window after a lost create answer. No key goes to another origin, and nothing is deleted.

Possible fix

When a GET confirms a marker-backed create, do not treat the returned key ID as proof that Coder holds the Secret's key. Either resend the current key once (an empty change token, as the "marker cleared" branch already does), or stall with KeyChangedExternally when the key's created_at is later than the provider's.

Found by the Codex review of #315 (round 5, r4267285180). Refs #154

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high