CoderMCPServer: disable the config when the control plane withdraws its opt-in (gate before M9) #336

Summary

When a CoderControlPlane withdraws its CoderMCPServer opt-in (spec.mcpServers), the CoderMCPServer controller stops before it reads the credential Secret. It does not disable the config in Coder. An enabled config then stays enabled, with its credentials, even though the control plane no longer allows the operator to manage MCP servers.

This was found by the independent advisor on the M6 stack (#328, #329, #330). #311 (Secret consent withdrawal) does not cover it.

Decision

Fail closed, as for CoderAIProvider (#267: a removed opt-in disables an enabled provider). When the opt-in is withdrawn and the object has a recorded config ID, the controller sends one PATCH that holds only enabled: false, and reports a clear reason. It sends no other write and reveals no credential.

Gate

This must land before M9 (CoderMCPServer activation). Add a test: opt-in removed → exactly one disable PATCH, then no further Coder writes while the opt-in stays removed.

Refs #155

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium