Cleanup follow-ups after #419: display-name delete proofs, legacy backfill, reason wording #422

Cleanup gaps that remain after #419 (which fixes #353). Each one exists on main before #419 or is a documented limit of it. An independent verifier reproduced items 1 and 3 on main.

1. Display-name proofs on delete. The CoderAIProvider sweep (for a record without a provider ID) and the CoderMCPServer live delete path still remove a resource whose display name matches the operator's temporary display name. Display names are editable in Coder, so a resource that a person renamed to that pattern can be removed. 🤖 fix: revoke a CoderProvisioner key created at an intermediate control plane endpoint #413 and 🤖 fix: keep recorded provider IDs and add cleanup records for MCP servers #419 adopted the rule "a record without a recorded ID never deletes" for provisioner keys and the MCP sweep. Apply the same rule here: keep the record, surface it (coder_k8s_cleanup_records_unmatched, ManualCleanupNeeded Event), and document manual cleanup.
2. An MCP config whose slug and display name were both edited after a lost create answer has nothing left that links it to its record. The sweep drops the record and the config stays in Coder.
3. Legacy-config backfill. A config made by an older operator version can end up without a record. This happens when the buildinfo read or the record write fails, and then the DELETE fails during the one bounded delete attempt while the control plane is being deleted. Codex thread: 🤖 fix: keep recorded provider IDs and add cleanup records for MCP servers #419 (comment)
4. CoderAIProvider reports DeletedExternally after a database switch, where CoderMCPServer now reports CoderDeploymentChanged. Nothing leaks, but the reason misleads. Copy the MCP check.
5. An MCP server whose status lost its config ID stalls with SlugConflict on its own config. Its delete still uses the recorded ID.
6. #362 items 1 and 4 are closed by decision: the control plane hold never ends early, because no signal proves that no dependent cleanup is in flight. Two attempts in 🤖 fix: finish the control plane hold and cleanup record follow-ups of #353 #410 were rejected for this reason. Reopen only with such a signal.

Refs #353, #419, #410

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high