claude-code: Add `boundary_config` or `boundary_config_path` input when `enable_boundary = true`

[matifali]

Problem

The enable_boundary = true option is documented but there's no way to pass a boundary config to the module directly. Users who need custom allow/deny rules must:

1. Write a separate coder_script resource that manually writes the config to ~/.config/coder_boundary/config.yaml
2. Know the exact path boundary expects (undocumented in the module README)
3. Ensure ordering so the file exists before boundary starts

The README implies enable_boundary = true "just works", but custom network rules require undocumented, non-obvious workarounds. The dogfood template in coder/coder handles this via a base64-encode-decode trick in a startup script — not beginner-friendly.

Proposed Solution

Add two optional inputs, where at least one must be provided when enable_boundary = true:

• boundary_config — inline YAML string
• boundary_config_path — path to a config file already on disk

module "claude-code" {
  source          = "registry.coder.com/coder/claude-code/coder"
  version         = "4.8.0"
  agent_id        = coder_agent.main.id
  enable_boundary = true

  # Option A: inline config
  boundary_config = <<-EOT
    allow:
      - "*.anthropic.com"
      - "*.github.com"
  EOT

  # Option B: path to file on disk
  # boundary_config_path = "/home/coder/.config/coder_boundary/config.yaml"
}

The module should validate that when enable_boundary = true, at least one of boundary_config or boundary_config_path is set (using a Terraform precondition or validation block), and write the inline config to the expected path internally if boundary_config is provided.

Why Both?

• boundary_config is best for self-contained templates (config lives in the template repo)
• boundary_config_path is best for cases where the file is provisioned separately or managed outside the template

[matifali]

I and @bartekgatzcoder ran into this today while preparing for a demo.

[DevelopmentCats]

I and @bartekgatzcoder ran into this today while preparing for a demo.

I should have a PR for this soon.