Use GITHUB_TOKEN env var for Pulumi GitHub provider

Pass the token via GITHUB_TOKEN environment variable which the Pulumi
GitHub provider reads automatically. Remove the one-time migration
workflow since state cleanup already succeeded.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -51,6 +51,7 @@ jobs:
       - name: Deploy to Production
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+          GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
         run: |
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           make up

.github/workflows/migrate-state.yml

@@ -1,78 +0,0 @@
-name: Migrate State (One-Time)
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-env:
-  PULUMI_VERSION: "3.197.0"
-
-jobs:
-  migrate:
-    name: Migrate Pulumi State
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-
-      - name: Setup Pulumi
-        uses: pulumi/actions@v6
-        with:
-          pulumi-version: ${{ env.PULUMI_VERSION }}
-
-      - name: Install Pulumi packages
-        run: pulumi install
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v2
-        with:
-          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
-
-      - name: Migrate State
-        env:
-          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
-          PULUMI_GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
-        run: |
-          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
-          export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
-
-          # Login to state backend
-          pulumi login gs://mcp-access-prod-pulumi-state
-
-          # Set the GitHub token in Pulumi config (will be encrypted)
-          pulumi config set --secret --stack prod github:token "$PULUMI_GITHUB_TOKEN"
-
-          # Clean up orphaned core team memberships from state
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::dsp-ant-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maxisbey-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::bhosmer-ant-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::crondinini-ant-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ochafik-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ihrpr-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::jerome3o-anthropic-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::felixweinberger-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maheshmurag-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::domdomegg-core' --yes || true
-          pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/team:Team::core' --yes || true
-
-          echo "State cleanup complete!"
-
-      - name: Commit updated Pulumi config
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add Pulumi.prod.yaml
-          git commit -m "Update encrypted GitHub token in Pulumi config" || echo "No changes to commit"
-          git push