Evaluate Pulumi for infrastructure-as-code

[sjawhar]

Context

We have credits for Pulumi and want to use good infrastructure-as-code wherever possible.

Scope

Evaluate whether the following infrastructure should be managed via Pulumi:

• Postgres database — currently a Docker container for testing; production would need a managed DB (e.g., Aurora Serverless, RDS, Neon)
• GitHub repo settings — branch protection rules, required status checks, CI workflow configuration
• Fleet deployment — syncing the plugin to multiple machines (sami-agents-mx, sami-claude, sami, ghost-wispr)
• SSH tunnels / networking — currently manual reverse tunnels for Postgres access from remote hosts
• Docker / container orchestration — if we move beyond a single test container

Questions to answer

1. Which of the above pieces would benefit most from Pulumi?
2. What's the right Pulumi provider stack? (e.g., @pulumi/aws for Aurora, @pulumi/github for repo settings)
3. Should the Pulumi project live in this repo or in a separate infra repo?
4. What's the minimum viable Pulumi stack that would replace the current manual setup?

Priority

Medium — not blocking current work, but would improve reproducibility and reduce manual fleet management overhead.