Set default empty PULUMI_CONFIG_PASSPHRASE for passphrase-based stacks

Stacks using KMS-based secrets providers ignore this. Stacks using the
default passphrase provider (e.g. the test stack) need it set to avoid
an interactive prompt.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ryan-williams

.github/workflows/pulumi.yml

@@ -62,6 +62,9 @@ on:
 # https://github.com/Open-Athena/pulumi/commits/patch
 env:
   PULUMI_FORK_SHA: ${{ inputs.pulumi-sha }}
+  # Default to empty passphrase for stacks using passphrase-based encryption.
+  # Stacks using KMS (secretsprovider: gcpkms://...) ignore this.
+  PULUMI_CONFIG_PASSPHRASE: ''
 
 jobs:
   pulumi: