CoderAIProvider Kind phases: check Coder's own 404 in P6, widen the E2E path filter, check the P7 reason #348

Summary

Three follow-ups to the CoderAIProvider Kind phases from the final assessment of #345 (A8). None blocks a release.

1. P6 checks curl's 404, not Coder's. hack/e2e-workspace-lifecycle.sh checks grep -q 'error: 404', which matches curl's own -f message. Check Coder's Resource not found or you do not have access to this resource message instead, the rule from 🤖 fix: check a CoderAIProvider's provider ID before Coder calls, and trust only Coder's own delete 404 #325.
2. E2E path filter misses credential files. .github/workflows/ci.yaml (the e2e path filter) does not list internal/controller/credential_checks.go or internal/credentialsecret/**. These decide the P3 refusals, so a PR that changes only them skips the Kind E2E on the PR (merge-queue and main runs still cover them). Add both.
3. P7 does not check the release reason. It checks only that the object is gone with the namespace. Check the ControlPlaneGone reason on e2e-ns-keep, or drop that claim from the docs/PR text.

Refs #154

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium