🤖 CoderWorkspacePool Share mode: an idle-reaped workspace that the pool keeps stays shared without policy checks #451

Problem

With claims.idleTimeoutSeconds (#447), the pool deletes the member of an idle claim. Right before the delete build, the member reads the workspace once more. If that read shows a use after the pool's idle check, or no last_used_at, the member keeps the workspace in Coder and releases its finalizer (internal/controller/coderworkspacepoolmember_cleanup.go, the result.kept path). The claim is then Lost with IdleTimeout.

For a Share claim (#446), the kept workspace still lists the shared user in its ACL with use. After the release, no member checks the share policy for that workspace any more. If an admin later removes the user from the listed groups, empties shareGroupIDs, or suspends the user, nothing removes the share.

Found by the Codex security review of #446 (P2): #446 (comment)

Impact

The user keeps the access that the policy granted before the release, on a workspace that the user was using a moment before. No data loss. The window to reach this path is short: a use between the pool's idle check and the member's last read. The same holds for other leftover workspaces, for example after a control plane delete (#448).

Design question

1. Remove the operator's ACL entry before the release. Then policy withdrawal can no longer matter, but the shared user loses the way back to the kept work: 🤖 feat: replace old unclaimed pool workspaces and reap idle claimed ones, both opt-in (#153 PR 15a) #447's message tells the claimant that coder ssh <owner>/<workspace> still reaches a kept workspace, and for a Share claim that works only through the share. Coder also applies the removal only after a restart (🤖 CoderWorkspacePool Share mode: optionally stop the workspace when a share is revoked #450).
2. Keep the share, and document that a kept Share workspace stays shared and needs a manual coder sharing remove when the admin cleans up leftovers.

Refs #153.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh