feat!: remove the Coder Tasks RBAC resource, scopes and permissions - #28750

Removes every in-repo Tasks client: the `coder exp tasks` CLI command
family, the tasks scaletest runner, and the task-driven triage
automation (`traiage.yaml`, `code-review.yaml`,
`classify-issue-severity.yml`, `scripts/traiage.sh`). Triage runs
through `triage-via-chat-api.yaml` and coder/create-agent-chat-action
instead.

**Stack context:** Coder Tasks removal stack (CODAGT-642): #28743
frontend → #28788 CLI → #28789 API → #28790 provisioner → #29084
notifications and usage → #29085 build reasons → #29086 tables → #28750
permissions. The last four PRs replace the single data-drop migration
that used to live in #28750; each carries one concern and a focused
migration test.

**Why:** clients come off before the API they call. After this layer
nothing in the repo invokes the Tasks API outside coderd itself.

**What to scrutinize:** all but three files are whole-file deletions.
`triage-via-chat-api.yaml` gets a comment fix. `NavbarView.tsx` and its
stories carry two small repairs to the frontend layer below (unused
`user` prop, stale `TasksFilter` story wiring) so the stack lints clean
from this layer up; they rebase away if folded into #28743.

**Validation:** `go build ./...`, `go test ./cli -run TestCommandHelp`,
site tsc, pre-commit hooks (gen, fmt, lint).

**Size:** +4/-6,938 over 42 files; effectively pure deletion, so it
reads much faster than the line count suggests.

> Created by Xum (AI agent) on behalf of @ibetitsmike.

Removes the Tasks API and task orchestration from coderd and codersdk:
the `/api/v2/tasks` handlers, task middleware and search filters, task
name generation, autobuild pause/resume logic, task notification
enqueues, telemetry, and the codersdk task types. Regenerates apidoc,
the API reference docs, and `typesGenerated.ts`.

**Breaking change:** the Tasks API is removed; requests to
`/api/v2/tasks` fail. Tasks was deprecated in v2.34.

**Stack context:** Coder Tasks removal stack (CODAGT-642): coder#28743
frontend → coder#28788 CLI → coder#28789 API → coder#28790 provisioner → coder#29084
notifications → coder#29085 build reasons → coder#29086 tables → coder#28750
permissions. The last four PRs replace the single data-drop migration
that used to live in coder#28750; each carries one concern and its own
migration number.

**Why:** with the UI (coder#28743) and CLI (coder#28788) gone, this deletes the
server surface. Database tables, RBAC, and notification templates stay
until the top of the stack so every layer builds and migrates
independently.

**What to scrutinize:**
- The `enable-ai-tasks` option is removed outright (review feedback):
configs still carrying `enableAITasks` fail to parse until the key is
deleted.
- provisionerdserver now writes `HasAITask: false` on template/build
flags; the column and these lines are dropped in coder#29085.
- `codersdk.ResourceTypeTask` stays so audit logs recorded before the
removal keep rendering.

**Validation:** `go build ./...`, `go vet ./...`, `go test
./codersdk/...`, site biome and tsc, CLI goldens regenerated, pre-commit
hooks.

**Size:** +242/-10,792 over 76 files; additions are regenerated
docs/goldens and test fixture updates.

> Created by Xum (AI agent) on behalf of @ibetitsmike.

Removes AI task support from the provisioner protocol: the task-related
proto fields, terraform scanning for `coder_ai_task` resources, echo
provisioner support, the regenerated `.pb.go` and
`provisionerGenerated.ts`, and the terraform testdata that exercised
them. The provisioner API version change lives in
`provisionerd/proto/version.go`.

**Stack context:** Coder Tasks removal stack (CODAGT-642): #28743
frontend → #28788 CLI → #28789 API → #28790 provisioner → #29084
notifications and usage → #29085 build reasons → #29086 tables → #28750
permissions. The last four PRs replace the single data-drop migration
that used to live in #28750; each carries one concern and a focused
migration test.

**Why:** the proto fields lost their last consumer in #28789; this
deletes the producer side and the wire format.

**What to scrutinize:** the proto/version handling, and that
`coder_ai_task` resources in existing templates are now ignored rather
than errors (template imports simply no longer scan for them).

**Validation:** `go build ./...`, `go test ./provisionersdk/...
./provisionerd/...`, `go test ./provisioner/terraform -run
TestConvertResources`, provisioner list golden regenerated, site tsc,
pre-commit hooks.

**Size:** +580/-1,286 over 76 files; most files are mechanical testdata
and generated-code updates.

> Created by Xum (AI agent) on behalf of @ibetitsmike.

Removes the six Coder Tasks notification templates (their preferences
and inbox history go with them via cascade) and the
`preference_task_notification_alert_dismissed` user setting with its two
queries. The `task` value of `ai_seat_usage_reason` stays: seats
consumed through tasks remain consumed, and remapping their reason would
misstate billing history.

**Breaking change:** migration 000592 deletes data. The down migration
restores the template definitions, not the deleted preferences or
notification history.

**Review changes:** dropped the `ai_seat_state` remap and enum swap and
the migration unit test (both per review); moved the migration from
000591 to 000592 because main took 000591.

**Stack context:** Coder Tasks removal stack (CODAGT-642): #28743
frontend → #28788 CLI → #28789 API → #28790 provisioner → **#29084
notifications** → #29085 build reasons → #29086 tables → #28750
permissions. The last four PRs replace the single data-drop migration
that used to live in #28750; each carries one concern and its own
migration number.

> Created by Xum (AI agent) on behalf of @ibetitsmike.

Drops the `has_ai_task` column from `template_versions` and
`workspace_builds` (with its index and view projections) and removes the
three task build reasons (`task_auto_pause`, `task_manual_pause`,
`task_resume`) from the `build_reason` enum. Existing rows are remapped
before the enum swap: automatic pauses become `autostop`, manual pauses
and resumes become `initiator`, and
`workspace_build_orchestrations.child_reason` follows the same mapping.
The query filters, provisionerdserver flag writes, and audit ignore
entries for the column go with it.

**Migration cost:** recreating `build_reason` rewrites
`workspace_builds`. `TestMigration000593TaskBuildReasonRewriteTiming`
seeds 1,000 workspaces, 100,000 builds (30,000 with task reasons) and
5,000 orchestrations and asserts the migration stays under a two-minute
bound; locally it takes about 0.7 to 1.0 s. The test is skipped under
`-short`.

**Breaking change:** the down migration re-adds `has_ai_task` as `false`
and restores the enum values; remapped reasons keep their new values.

**Review changes:** the migration test now asserts only the row remaps
(schema and enum introspection removed per review); renumbered from
000592 to 000593.

**Stack context:** Coder Tasks removal stack (CODAGT-642): coder#28743
frontend → coder#28788 CLI → coder#28789 API → coder#28790 provisioner → coder#29084
notifications → **coder#29085 build reasons** → coder#29086 tables → coder#28750
permissions. The last four PRs replace the single data-drop migration
that used to live in coder#28750; each carries one concern and its own
migration number.

> Created by Xum (AI agent) on behalf of @ibetitsmike.

Drops the `tasks`, `task_workspace_apps` and `task_snapshots` tables,
the `tasks_with_status` view and the `task_status` enum, and recreates
`workspaces_expanded` without the `tasks` join and `task_id` column.
Deletes `queries/tasks.sql` and every wrapper, fixture and test that
existed only for those queries (dbauthz, dbmock, dbmetrics, dbfake,
dbgen, querier_test), plus the `task_id` projection in
`GetWorkspaceAgentAndWorkspaceByAuthToken`.

**Breaking change:** migration 000594 deletes all task rows. The down
migration restores the schema (tables, constraints, indexes, views), not
the data.

**Review changes:** the schema-only migration test was removed per
review (`TestMigrate/UpDownUp` still exercises the down path), the test
file no longer reorders existing tests, and the migration moved from
000593 to 000594. The `dump.sql` reorder is pg_dump dependency ordering:
`tasks_with_status` pulled its four workspace tables ahead of it, and
without the view they return to alphabetical positions.

**Stack context:** Coder Tasks removal stack (CODAGT-642): #28743
frontend → #28788 CLI → #28789 API → #28790 provisioner → #29084
notifications → #29085 build reasons → **#29086 tables** → #28750
permissions. The last four PRs replace the single data-drop migration
that used to live in #28750; each carries one concern and its own
migration number.

> Created by Xum (AI agent) on behalf of @ibetitsmike.


## Delivery record

**Decision (2026-09-11 ~14:40Z): merge** through the stack merge
endpoint, squash, pinned to head
`f1d236a0c82f123b8a0d6878799c227ef9bd5776` (merge SHA appended below
once landed).

**Independent substantive reviews on this PR (3):**

| # | Kind | Reviewed commit | Findings and disposition | Source |
|---|---|---|---|---|
| 1 | Codex code review (bot), PR opened | `24535f8410` | No findings,
no threads |
[summary](#29086 (comment))
|
| 2 | Human review, spikecurtis (COMMENTED) | `24535f8410` | 4 findings:
dump.sql reorder question (answered: pg_dump dependency hoisting by
`tasks_with_status`); two moved tests (undone, the test file is no
longer touched); schema-only migration test (deleted). All resolved. |
[review](#29086 (review))
|
| 3 | Human review, spikecurtis (APPROVED) | `f1d236a0c8` (this head) |
Approval on the exact final head |
[review](#29086 (review))
|

The four COMMENTED reviews by @ibetitsmike on `f35688f40b` are
thread-reply wrappers and are not counted.

**Pre-split history relevant to this diff:** this layer's content lived
in the monolithic #28750 until 2026-09-08, which received 10 completed
Codex code reviews (2026-08-28 to 2026-09-01) and spikecurtis's
CHANGES_REQUESTED review of 2026-09-04 that asked for the split.
Counting those, the completed-review total relevant to this diff exceeds
the six-review budget, so no further discretionary review or fresh final
advisory was commissioned. The usable final recommendation for the final
diff is review 3 above: the reviewer who authored every finding on this
layer approved the exact head.

**Exact-head checks:** `required` SUCCESS in [run
34580949353](https://github.com/coder/coder/actions/runs/34580949353/job/103205933212);
rollup 15 success, 8 skipped, 1 failure. The failure is the non-required
`Analyze PR for Documentation Updates Needed` job
([103204101137](https://github.com/coder/coder/actions/runs/34580949071/job/103204101137)),
caused by the dormant `doc-check-pr-29086` review workspace
(CODAGT-1025), not a code finding; GitHub flags only `required` as
required for this PR. Merge-ref freshness: `refs/pull/29086/merge` has
the exact head as second parent and `25af21b5d5d` (the #29085 squash) as
first parent; main has since gained #29231, #28639 and #29218 (12 files,
none overlapping this PR). The composed tree (`git merge-tree` of
current main and this head) builds (`go build ./...`) and vets (`go vet`
on `coderd`, `coderd/database/...`, `coderd/wsrelated/...`) cleanly.
Layer diff parity with the previously pushed layer verified by numstat
after both GitHub restacks. `gh stack push` did not run the local
pre-push suite; CI is the validation evidence.

**Deferred:** the dormant doc-check workspace (CODAGT-1025) is outside
this PR. Next in the stack, #28750, stays blocked: CHANGES_REQUESTED,
its approval and CI predate the restack, and its review budget is
exhausted.