bug: parameter deletion guard depends on a diagnostic preview infers #29814

Summary

ResolveParameters only narrows the stored parameter set when the render is
complete, and decides completeness from a single signal
(coderd/dynamicparameters/resolver.go):

if transition == database.WorkspaceTransitionStart && !incompleteRender(diags) {
    // delete stored values for parameters missing from this render
}

incompleteRender returns true when preview emits module_not_loaded. preview
infers that diagnostic rather than detecting it, so the signal is wrong in
both directions.

Why this matters

False positive. preview reports modules as not loaded when they loaded
correctly (coder/preview#228). On main that permanently pins affected
templates into "incomplete render", so values for parameters the template
genuinely removed are never cleaned up. Reproduced on main with the vendored
preview: four spurious diagnostics on a template whose parameters all render.

False negative. The diagnostic is inferred from whether any parsed block
references each module block. A module that loads but contributes no blocks, or
a future change in the inference, produces no diagnostic while parameters are
still missing from the render. The guard then deletes stored values, which is
the failure mode #29099 described.

coderd does not need to infer any of this. It knows whether it handed the
renderer the module files: template_version_terraform_values.cached_module_files
is what render.go overlays at .terraform/modules. A NULL archive is not on
its own evidence of anything, because provisionerd only archives remotely
sourced modules, so a template whose modules are all local stores nothing and
still renders completely (GetModulesArchive returns zero bytes for it). The
cached plan supplies the missing half: configuration.root_module.module_calls
lists each call and its source, at every depth.

Proposed fix

Decide completeness from coderd's own state: a version that depends on a
remotely sourced module but has no cached module archive cannot be rendered
completely. Keep the preview diagnostic as a fallback so behaviour is never
weaker than today. PR linked below.

Related

• bug: "Module not loaded" reported for modules that loaded correctly preview#228 removes the false positive at its source. This issue is
  about not depending on that inference for data safety.
• Silent parameter-value loss when a template version's module cache is absent #29099, fix(coderd): keep parameter values when the render is incomplete #29108, fix(coderd): do not narrow the parameter set on non-start builds #29102 for the original data-loss path.
• The skipped-modules list from the 20MB archive cap is still logged and
  discarded (provision.go TODO), with no UI or API surface. Same class of
  problem, tracked separately.

Filed by Coder Agents on behalf of @angrycub.