🤖 docs: add GitOps health rules for CoderMCPServer

[ThomasK33]

Summary

Argo CD and Flux can now wait for a CoderMCPServer. This PR adds the health rules in config/gitops/ and copies them into the CoderMCPServer how-to, as #212 did for CoderTemplateTest. I moved them out of #381 to keep that PR near 500 lines.

The rules

Both rules wait until status.observedGeneration equals metadata.generation. Then they read the conditions:

Conditions	Argo CD	Flux
no status, or a stale observedGeneration	Progressing	InProgress (Unknown before the first status)
Reconciling=True	Progressing	InProgress
Ready=True	Healthy	Current
Stalled=True	Degraded	Failed

The Argo CD message is <reason>: <message> of the Ready condition. While the object is being deleted, Argo CD shows Deleting the Coder MCP server config.

• config/gitops/argocd-health-codermcpserver.lua: the argocd-cm key resource.customizations.health.coder.com_CoderMCPServer.
• config/gitops/flux-healthcheck-codermcpserver.yaml: an entry for spec.healthCheckExprs of a Flux v2.5+ Kustomization with spec.wait: true.
• docs/how-to/manage-mcp-servers.md: a new section "GitOps health checks" with both rules.

Validation

• config/gitops/health_test.go now runs one table per kind. The CoderMCPServer cases use reasons that the controller sets: Applied, ControlPlaneNotReady, CoderUnavailable, GroupNotFound, MCPServersNotAllowed, DisabledExternally, CredentialNotOptedIn, SlugConflict, plus no status, a stale generation, no conditions, and two deletion cases. Both the Lua script (gopher-lua) and the Flux CEL expressions run against every case. TestDocCopiesRules checks that the how-to copies equal the files.
• Mutation checks (in 🤖 feat: activate the CoderMCPServer controller #381, before the move): Lua Degraded changed to Progressing, Flux failed set to false, and a doc copy that drifts each make a test fail.
• Local gates on this head: make verify-vendor, make build, make lint, GOFLAGS=-mod=vendor go tool govulncheck ./..., make test, make test-integration, go test -race ./internal/controller/, and make docs-check pass. make codegen, make manifests, make build-installer and make docs-reference leave no diff.

Size

251 changed lines: 37 in the two rule files, 154 in the test (mostly the per-kind table), 60 in the how-to.

Refs #155

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $224.47

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T19:19:58.001394Z	42c3ae5	PR opened
🔒 Security Review	✅ Completed 2026-10-14T19:20:51.554889Z	42c3ae5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 42c3ae522f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.