fix: scope git askpass diff status updates to initiating chat (#22534)

## Problem

When the git askpass flow triggered diff status refreshes, it updated
**every chat** connected to the workspace. This was wasteful and could
cause confusing status updates on unrelated chats.

## Solution

Thread the chat ID through the entire git askpass flow so only the chat
that initiated the git operation gets updated:

1. **`coderd/chatd/chattool/execute.go`** — Sets `CODER_CHAT_ID` env var
on spawned processes (alongside the existing `CODER_CHAT_AGENT`)
2. **`cli/gitaskpass.go`** — Reads `CODER_CHAT_ID` from the environment
and sends it as a `chat_id` query parameter in the `ExternalAuthRequest`
3. **`codersdk/agentsdk/agentsdk.go`** — Adds `ChatID` field to
`ExternalAuthRequest` and encodes it as a query param
4. **`coderd/workspaceagents.go`** — Parses `chat_id` query param and
passes it through to `storeChatGitRef` and
`triggerWorkspaceChatDiffStatusRefresh`
5. **`coderd/chats.go`** — `storeChatGitRef` and
`refreshWorkspaceChatDiffStatuses` now scope updates to just the
initiating chat when a chat ID is provided, falling back to
all-workspace-chats behavior for backwards compatibility (non-chat git
operations)

codersdk/agentsdk/agentsdk.go

@@ -646,6 +646,8 @@ type ExternalAuthRequest struct {
 	// Sent by the agent so the control plane can resolve diffs
 	// without SSHing into the workspace.
 	GitRemoteOrigin string
+	// ChatID identifies which chat initiated the git operation.
+	ChatID string
 	// Listen indicates that the request should be long-lived and listen for
 	// a new token to be requested.
 	Listen bool
@@ -667,6 +669,9 @@ func (c *Client) ExternalAuth(ctx context.Context, req ExternalAuthRequest) (Ext
 	if req.GitRemoteOrigin != "" {
 		q.Set("git_remote_origin", req.GitRemoteOrigin)
 	}
+	if req.ChatID != "" {
+		q.Set("chat_id", req.ChatID)
+	}
 	reqURL := "/api/v2/workspaceagents/me/external-auth?" + q.Encode()
 	res, err := c.SDK.Request(ctx, http.MethodGet, reqURL, nil)
 	if err != nil {

codersdk/agentsdk/agentsdk_test.go

@@ -165,6 +165,7 @@ func TestExternalAuthRequestQuery(t *testing.T) {
 			require.Equal(t, "true", r.URL.Query().Get("listen"))
 			require.Equal(t, "main", r.URL.Query().Get("git_branch"))
 			require.Equal(t, "https://github.com/coder/coder.git", r.URL.Query().Get("git_remote_origin"))
+			require.Equal(t, "test-chat-id", r.URL.Query().Get("chat_id"))
 			require.False(t, r.URL.Query().Has("workdir"))
 			_, _ = w.Write([]byte(`{"type":"github","access_token":"token"}`))
 		}))
@@ -179,6 +180,7 @@ func TestExternalAuthRequestQuery(t *testing.T) {
 			Listen:          true,
 			GitBranch:       "main",
 			GitRemoteOrigin: "https://github.com/coder/coder.git",
+			ChatID:          "test-chat-id",
 		})
 		require.NoError(t, err)
 	})