fix(ci): reserialize dynamic providers before refresh

Split `make up` into two phases: a plain `pulumi up` first, then
`pulumi up --refresh`. Dynamic providers serialize their implementation
into state at create/update time. During refresh, the serialized `read()`
runs — so any provider-code change (like the Discord 429 retry logic)
doesn't take effect until a successful update writes the new `__provider`
to state. Running refresh first used the stale serialized code from the
last successful deploy, which had no rate-limit handling, failing on
parallel Discord member lookups.

Also bump discordFetch maxRetries from 5 to 10 for headroom against ~68
parallel refresh reads.

Makefile

@@ -16,4 +16,8 @@ refresh: login ## Refresh state to match reality
 	PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi refresh --yes --stack prod
 
 up: login ## Deploy infrastructure (with refresh to detect drift, e.g. expired org invites)
+	# Dynamic providers serialize their implementation into state. Run a plain
+	# `up` first so any provider-code changes are captured, then refresh with the
+	# freshly serialized `read()`. Otherwise refresh runs stale code and fails.
+	PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi up --yes --stack prod
 	PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi up --refresh --yes --stack prod

src/discord.ts

@@ -34,7 +34,7 @@ async function discordFetch<T>(
   token: string,
   endpoint: string,
   options: RequestInit = {},
-  maxRetries = 5
+  maxRetries = 10
 ): Promise<T> {
   let lastError: Error | undefined;