CoderMCPServer: trust only Coder's own 404 on the organization lookup, and requeue MCPServersNotAllowed (before M9) #358

Summary

In the CoderMCPServer controller, the organization lookup (internal/controller/codermcpserver_controller.go, the 404 branch of the organization read) still trusts any 404. A 404 that Coder did not send can skip the disable that runs when a credential Secret withdraws consent:

1. A lookup of spec.organization that gets a proxy 404 returns before the disable.
2. A lookup of a listed alias that gets a proxy 404 is skipped. The scope check can then fail with MCPServersNotAllowed, and that stall has no timed requeue, so it waits for the next watch event.

Any failed organization read skips the disable in the same way, so the behavior is not new. No credential is sent.

Fix

Use isCoderResourceNotFound for the organization lookup, and give MCPServersNotAllowed a timed requeue. Add tests for an HTML 404 and Route not found..

Gate: before M9 (CoderMCPServer activation).

Found by the final assessment of #356. Refs #155

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium