Fix SQLMesh config and CI/CD deployment issues

- Fix SQLMesh config: Add semicolons to SQL statements in before_all hooks
  - Resolves "unsupported syntax" warning for CREATE SECRET and ATTACH
  - DuckDB requires semicolons to terminate statements properly

- Fix deploy:infra job: Update Pulumi authentication
  - Remove `pulumi login --token` (not supported in Docker image)
  - Use PULUMI_ACCESS_TOKEN environment variable directly
  - Chain commands with && to avoid "unknown command 'sh'" error

- Fix deploy:supervisor job: Update esc login syntax
  - Change `esc login --token` to `esc login` (--token flag doesn't exist)
  - esc CLI reads token from PULUMI_ACCESS_TOKEN env var
  - Simplify Pulumi CLI installation (remove apk fallback logic)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

transform/sqlmesh_materia/config.yaml

@@ -22,14 +22,14 @@ before_all:
     CREATE SECRET IF NOT EXISTS r2_secret (
         TYPE ICEBERG,
         TOKEN '@env_var("CLOUDFLARE_API_TOKEN")'
-    )
+    );
   - |
     ATTACH '@env_var("R2_WAREHOUSE_NAME", "materia")' AS catalog (
         TYPE ICEBERG,
         ENDPOINT '@env_var("ICEBERG_REST_URI")'
-    )
-  - CREATE SCHEMA IF NOT EXISTS catalog.materia
-  - USE catalog.materia
+    );
+  - CREATE SCHEMA IF NOT EXISTS catalog.materia;
+  - USE catalog.materia;
 
 # --- Model Defaults ---
 # https://sqlmesh.readthedocs.io/en/stable/reference/model_configuration/#model-defaults