Add Discord role sync with role-centric architecture (#22)

* Add Discord role sync with role-centric architecture

This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).

Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
  (e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers

Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.

Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID

* Fix GitHub team ordering and make Discord integration optional

- Add topological sort for GitHub teams to ensure parent teams are
  created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
  config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Reconcile Discord roles for listed users

Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)

Users not in config remain untouched.

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Fix descriptions to match existing resources

* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install

* Remove accidentally committed state backup

* Use github.token for pulumi install

* Fix formatting

Fix deploy: add pulumi login before config set

Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands

Import existing docs-maintainers team (remove after deploy)

Remove docs-maintainers import workaround

Add docs-maintainers cleanup to state cleanup

Add pulumi refresh before up to sync state with reality

Rename Discord roles to add (synced) suffix

Cleanup Makefile and add lead-maintainers GitHub team

src/github.ts

@@ -1,40 +1,61 @@
 import * as github from '@pulumi/github';
-import { GROUPS } from './config/groups';
+import { ROLES, type Role, buildRoleLookup } from './config/roles';
 import { REPOSITORY_ACCESS } from './config/repoAccess';
-import type { Group } from './config/utils';
 import { MEMBERS } from './config/users';
+import { sortRolesByGitHubDependency } from './config/utils';
+import type { RoleId } from './config/roleIds';
 
+const roleLookup = buildRoleLookup();
+// Teams keyed by GitHub team name (matches repoAccess.ts references)
 const teams: Record<string, github.Team> = {};
 
-GROUPS.forEach((group: Group) => {
-  // Skip groups that don't include github in their platforms
-  if (group.onlyOnPlatforms && !group.onlyOnPlatforms.includes('github')) return;
+// Sort roles so parent teams are created before child teams
+const sortedRoles = sortRolesByGitHubDependency(ROLES, roleLookup);
 
-  teams[group.name] = new github.Team(group.name, {
-    name: group.name,
-    description: group.description + ' \n(Managed by github.com/modelcontextprotocol/access)',
+// Create GitHub teams for roles that have GitHub config
+sortedRoles.forEach((role: Role) => {
+  if (!role.github) return;
+
+  // Resolve parent team ID if specified
+  // Parent is guaranteed to exist in `teams` due to topological sort
+  let parentTeamId: github.Team['id'] | undefined;
+  if (role.github.parent) {
+    const parentRole = roleLookup.get(role.github.parent);
+    if (parentRole?.github) {
+      parentTeamId = teams[parentRole.github.team]?.id;
+    }
+  }
+
+  teams[role.github.team] = new github.Team(role.github.team, {
+    name: role.github.team,
+    description: role.description + ' \n(Managed by github.com/modelcontextprotocol/access)',
     privacy: 'closed',
-    parentTeamId: group.memberOf?.[0] ? teams[group.memberOf[0]].id : undefined,
+    parentTeamId,
   });
 });
 
+// Create team memberships
 MEMBERS.forEach((member) => {
   if (!member.github) return;
 
-  member.memberOf.forEach((teamKey) => {
-    new github.TeamMembership(`${member.github}-${teamKey}`, {
-      teamId: teams[teamKey].id,
+  member.memberOf.forEach((roleId: RoleId) => {
+    const role = roleLookup.get(roleId);
+    if (!role?.github) return; // Role doesn't have GitHub config
+
+    new github.TeamMembership(`${member.github}-${role.github.team}`, {
+      teamId: teams[role.github.team].id,
       username: member.github!,
       role: 'member',
     });
   });
 });
 
+// Configure repository access
 REPOSITORY_ACCESS.forEach((repo) => {
   new github.RepositoryCollaborators(`repo-${repo.repository}`, {
     repository: repo.repository,
     teams: repo.teams?.map((t) => ({
-      teamId: teams[t.team].id,
+      teamId: teams[t.team]?.id,
       permission: t.permission,
     })),
     users: repo.users?.map((u) => ({
@@ -43,3 +64,5 @@ REPOSITORY_ACCESS.forEach((repo) => {
     })),
   });
 });
+
+export { teams as githubTeams };