🤖 CoderWorkspacePool Share mode: shares stay while a control plane is being deleted #448

Problem

When a CoderControlPlane is being deleted, pool members make no Coder call (plan 6.5 item 3 of #153). So a member of a Share pool no longer checks or removes its share. The shared Coder user keeps the use role on the workspace for as long as Coder keeps running after the delete started. Coder can keep running for up to 10 minutes while the control plane's finalizer waits for AI gateway keys, AI providers, and MCP servers. If Coder's database survives the delete, the leftover kwp- workspaces keep their shares too.

Found by the Codex security review of #446 (round 3, P3): #446 (comment)

Impact

The user keeps only the access that the share policy granted before the delete. The admin did not withdraw the policy in Coder. No data loss. #446 documents the behavior in the pool how-to (Cleanup section) and tells admins to delete the Share claims before the control plane.

Options

1. Treat the control plane's delete as a withdrawn share policy. Members of Share claims then remove their shares with the deleting-control-plane client (controlPlaneCoderClientFor(..., allowDeleting=true), today used only by the AI and MCP cleanups, plan D12). The control plane's finalizer then also has to wait for these members, within its time limit.
2. Keep the current behavior and keep the docs note.

Option 1 changes the cleanup design of plan PRs 12 to 14, so it needs a plan decision. Refs #153.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh