CoderAIProvider create path: trust only Coder's own 404 on name lookups #338

Summary

The CoderAIProvider create path still treats any 404 on its name lookups as "not found" (internal/controller/coderaiprovider_create.go, the confirm read before a create and the read after a rejected create). #335 fixed the sync and disable paths, and #325 fixed delete.

Impact

A 404 that Coder did not send (a proxy page, Route not found.) can clear the create marker even when an earlier create committed. If the object is deleted while the marker is cleared, the finalizer is released without a delete in Coder, and Coder keeps a provider that holds the key.

The risk is limited: Coder created that provider with enabled: false, and the apply step never ran, so Coder does not use the key. It needs a proxy 404 on the name lookup, a committed create, and a delete at the same time. No duplicate provider is possible (Coder's unique name index answers 409), and ownership is not lost.

Fix

Use isCoderResourceNotFound for both create-path lookups. A non-Coder 404 waits with CoderUnavailable and keeps the marker. Add tests for an HTML 404 and Route not found.. Also a docs nit: the kill-switch line in docs/how-to/manage-ai-providers.md says the operator disables the provider "at once"; add that a failed Coder call (including a proxy 404) retries every 30 s with a message that starts with Coder can still send the key.

Should land before the next release tag if it is ready in time; not a hard blocker.

Found by the final assessment of #335. Refs #154

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium