Simplify supervisor architecture and automate bootstrap

- Simplify supervisor.sh following TigerBeetle pattern
  - Remove complex functions, use simple while loop
  - Add || sleep 600 for resilience against crashes
  - Use git switch --discard-changes for clean updates
  - Run pipelines every hour (SQLMesh handles scheduling)
  - Use POSIX sh instead of bash

- Remove /repo subdirectory nesting
  - Repository clones directly to /opt/materia
  - Simpler paths throughout

- Move systemd service to repo
  - Bootstrap copies from repo instead of hardcoding
  - Service can be updated via git pull

- Automate bootstrap in CI/CD
  - deploy:supervisor now auto-bootstraps on first deploy
  - Waits for SSH to be ready (retry loop)
  - Injects secrets via SSH environment
  - Idempotent: detects if already bootstrapped

Result: Push to master and supervisor "just works"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -307,3 +307,6 @@ Supervisor: uv run materia pipeline run <pipeline>
 Note: The dev database is large and should not be committed to git (.gitignore already configured).
 - We use a monorepo with uv workspaces
 - The pulumi env is called beanflows/prod
+- NEVER hardcode secrets in plaintext
+- Never add ssh keys to the git repo!
+- If there is a simpler more direct solution and there is no other tradeoff, always choose the simpler solution