docs: give ci-bot organization-template-admin; tick #208 OpenSpec tasks (#209) [skip ci]

[rfay]

The Issue

Follow-up to #208; these two commits were ready but missed that merge.

#208 added scripts/ci-show-provisioner-errors.sh, which runs after every coder create in the integration workflows. When the server-side Terraform step fails, the Coder CLI often prints only initialize terraform: exit status 1, and this script prints the real error from the failed provisioner job's logs. To read those logs, the CI user needs the organization-template-admin org role. The site-wide template-admin role alone can't list provisioner jobs, and without the org role the script can only print a warning. The staging setup docs didn't mention the org role.

How This PR Solves The Issue

• docs/admin/server-setup.md: "Create the CI bot user on staging" now includes coder organizations members edit-roles ci-bot organization-template-admin, with a short explanation of why it's needed. ci-bot already has this role on staging-coder.ddev.com (granted 2026-09-24); the command was run there as written.
• openspec/changes/add-user-startup-hook/tasks.md: ticks task 2.3 (the integration test passed on staging) and adds 2.4 (the manual end-to-end check on staging: a ~/.coder-startup.sh that starts a Claude Code self-hosted runner in tmux brought it up after a workspace restart with no terminal open, and a session ran on it).

Manual Testing Instructions

None needed: this changes a doc and a task list. To check the role on a server: coder organizations members list should show ci-bot with [Organization Template Admin].

Automated Testing Overview

No code changes. openspec validate add-user-startup-hook --strict passes.

Release/Deployment Notes

On any Coder server the integration tests run against, give the CI user the org role once. On staging-coder.ddev.com this is already done.

🤖 Generated with Claude Code

https://claude.ai/code/session_017LNV7pCH3fCUkVkhto13Ev

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-24 22:38 UTC

[rfay]

Push to staging (drupal-core) failed on 5a1abb1, and the cause isn't this PR. This PR only changes docs/admin/server-setup.md and an OpenSpec task list.

The staging Coder server couldn't download the vscode-web Terraform module while importing the template:

Error: Failed to download module
Could not download module "vscode-web" (template.tf:1323) source code from "https://registry.coder.com/download/coder/1.6.2-vscode-web.tar.gz": ... TLS handshake timeout
error: template import init error: initialize terraform: exit status 1

This is the same intermittent registry.coder.com timeout seen several times today on #208 (see this comment). There's no fix in this repo yet. I'll re-run the job once when the rest of its workflow run finishes.

---

Generated by Claude Code