Add one-off pulumi refresh step to fix out-of-sync Cloudflare state

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -48,6 +48,14 @@ jobs:
         with:
           credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
 
+      - name: Refresh Pulumi state (one-off fix for out-of-sync state)
+        env:
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          pulumi login gs://mcp-dns-prod-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi refresh --yes --stack prod
+
       - name: Deploy to Production
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}

package.json

@@ -10,8 +10,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@pulumi/cloudflare": "^6.12.0",
-    "@pulumi/pulumi": "^3.214.1"
+    "@pulumi/cloudflare": "^6.13.0",
+    "@pulumi/pulumi": "^3.218.0"
   },
   "devDependencies": {
     "@types/node": "^22.18.6",