CVE-2026-55433: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

The devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild.

Note: Exploitation requires an existing low-privilege role with access to the target workspace.