Add one-time migration workflow to set GitHub token and clean up state

- Add migrate-state.yml workflow (manual trigger) that:
  - Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret
  - Cleans up orphaned 'core' team memberships from state
  - Commits the updated Pulumi.prod.yaml back to repo
- Revert deploy.yml to use encrypted token from Pulumi config

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -51,7 +51,6 @@ jobs:
       - name: Deploy to Production
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
-          GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
         run: |
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           make up