## What
`ExtractWorkspaceAgentAndLatestBuild` computed the workspace owner's
RBAC subject via `UserRBACSubject`, but discarded the returned user
status. As a result, workspace agent requests were still authorized even
when the owner's account was suspended.
This change captures `userStatus` and rejects the request with `401
Unauthorized` when the owner is not `Active`, returning a clear message
directing the user to contact an admin to reactivate the account.
## Changes
- `coderd/httpmw/workspaceagent.go`: stop discarding the owner status
from `UserRBACSubject`; return `401` when the owner is not active.
- `coderd/httpmw/workspaceagent_test.go`: add an `InactiveUser` test
that suspends the owner and asserts a `401` with the expected message.
## Testing
- New `TestWorkspaceAgent/InactiveUser` unit test covers the
suspended-owner path.
---
> This PR was created by Coder Agents on behalf of @hwang251.
Hank Hwang
2f50b2d740