Simplify supervisor architecture and automate bootstrap

- Simplify supervisor.sh following TigerBeetle pattern
  - Remove complex functions, use simple while loop
  - Add || sleep 600 for resilience against crashes
  - Use git switch --discard-changes for clean updates
  - Run pipelines every hour (SQLMesh handles scheduling)
  - Use POSIX sh instead of bash

- Remove /repo subdirectory nesting
  - Repository clones directly to /opt/materia
  - Simpler paths throughout

- Move systemd service to repo
  - Bootstrap copies from repo instead of hardcoding
  - Service can be updated via git pull

- Automate bootstrap in CI/CD
  - deploy:supervisor now auto-bootstraps on first deploy
  - Waits for SSH to be ready (retry loop)
  - Injects secrets via SSH environment
  - Idempotent: detects if already bootstrapped

Result: Push to master and supervisor "just works"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

infra/supervisor/materia-supervisor.service

@@ -7,12 +7,10 @@ Wants=network-online.target
 Type=simple
 User=root
 WorkingDirectory=/opt/materia
-Environment="PATH=/usr/local/bin:/usr/bin:/bin:/root/.pulumi/bin"
-EnvironmentFile=/opt/materia/.env
-
-# Restart policy
+ExecStart=/opt/materia/infra/supervisor/supervisor.sh
 Restart=always
 RestartSec=10
+EnvironmentFile=/opt/materia/.env
 
 # Resource limits
 LimitNOFILE=65536
@@ -22,8 +20,5 @@ StandardOutput=journal
 StandardError=journal
 SyslogIdentifier=materia-supervisor
 
-# Execute supervisor script
-ExecStart=/opt/materia/supervisor.sh
-
 [Install]
 WantedBy=multi-user.target