CoderProvisioner: inherited key-record pruning and legacy-record limits after #420 #424

Residual CoderProvisioner key-record limits after #420 (fixes #414 and #417). An independent verifier reproduced item 1 on main (ae231a98) and on the #420 head, so #420 does not introduce it.

1. Inherited pruning rule drops older live records after an upgrade. Before it writes the next create intent, the controller keeps only the newest pending target record that has IDs (coderprovisioner_controller.go, the pruning block that was at lines 323-339 on main). That rule assumes an earlier create at the same logical name proved the earlier keys gone. Organization-name reuse breaks the assumption. An older operator can leave two live target records under different organization IDs. The next reconcile then drops the older one, and its key stays valid in Coder. 🤖 fix: a CoderProvisioner replaces only keys it recorded and binds key records to the control plane UID #420 stops new replacements from building that state: it deletes each recorded target key by ID before the next create. Status written by an older operator can still hold it. Fix: never prune a record that has a key ID. Delete it by ID first, and drop it only on Coder's own 404.
2. A legacy record (no control plane UID) whose URL now reaches a fresh backend. The recorded organization at that URL answers 404 for the key, so the record is dropped. If an administrator later routes the URL back to the old backend, the key there is still valid and nothing records it. Without a recorded UID, the operator cannot identify the original backend. Revoke such keys by hand.
3. Coder deletes provisioner keys only by name. DeleteProvisionerKeyByID lists by organization ID, matches the key ID, then calls the delete-by-name endpoint. An external delete and re-create between the list and the delete can remove the replacement key. Closing this needs a Coder API that deletes by ID.

Refs #414, #417, #420, #416

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high