Fix SQLMesh config and CI/CD deployment issues

- Fix SQLMesh config: Add semicolons to SQL statements in before_all hooks
  - Resolves "unsupported syntax" warning for CREATE SECRET and ATTACH
  - DuckDB requires semicolons to terminate statements properly

- Fix deploy:infra job: Update Pulumi authentication
  - Remove `pulumi login --token` (not supported in Docker image)
  - Use PULUMI_ACCESS_TOKEN environment variable directly
  - Chain commands with && to avoid "unknown command 'sh'" error

- Fix deploy:supervisor job: Update esc login syntax
  - Change `esc login --token` to `esc login` (--token flag doesn't exist)
  - esc CLI reads token from PULUMI_ACCESS_TOKEN env var
  - Simplify Pulumi CLI installation (remove apk fallback logic)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitlab-ci.yml

@@ -57,11 +57,9 @@ deploy:infra:
   stage: deploy
   image: pulumi/pulumi:latest
   before_script:
-    - pulumi login --token ${PULUMI_ACCESS_TOKEN}
+    - export PULUMI_ACCESS_TOKEN="${PULUMI_ACCESS_TOKEN}"
   script:
-    - cd infra
-    - pulumi stack select prod
-    - pulumi up --yes
+    - cd infra && pulumi stack select prod && pulumi up --yes
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 
@@ -72,15 +70,12 @@ deploy:supervisor:
     - apk add --no-cache openssh-client curl bash
     - curl -fsSL https://get.pulumi.com/esc/install.sh | sh
     - export PATH="$HOME/.pulumi/bin:$PATH"
-    - esc login --token ${PULUMI_ACCESS_TOKEN}
+    - export PULUMI_ACCESS_TOKEN="${PULUMI_ACCESS_TOKEN}"
+    - esc login
     - eval $(esc env open beanflows/prod --format shell)
     # Install Pulumi CLI to get stack outputs
-    - |
-      apk add --no-cache pulumi-bin || {
-        curl -fsSL https://get.pulumi.com/install.sh | sh
-        export PATH="$HOME/.pulumi/bin:$PATH"
-      }
-    - pulumi login --token ${PULUMI_ACCESS_TOKEN}
+    - curl -fsSL https://get.pulumi.com/install.sh | sh
+    - export PATH="$HOME/.pulumi/bin:$PATH"
   script:
     - |
       # Get supervisor IP from Pulumi