Build the Pulumi binary before running Pulumi

Pulumi.yaml sets runtime.options.binary to ./gitea-infra, which tells the
Go language host to execute that file instead of compiling the program.
Nothing produced it: `make check` ran `go build ./...`, which discards
output when building multiple packages, and the infra Cloud Build step
went straight to `pulumi up`. Both local preview/up and the first infra
trigger run would fail before planning anything.

`make check` (and therefore preview/up) now builds it with -o, and the
infra pipeline builds it at the top of the pulumi step. `go vet ./...`
still type-checks every package.

Also corrects the Makefile's ZONE fallback from <region>-a to <region>-b.
It applies whenever `pulumi config get` cannot read the stack, and
us-east1 has no -a zone, so make ssh/build would target a zone that does
not exist. -b matches the default in infra/pkg/config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -3,7 +3,8 @@
 
 PROJECT ?= $(shell cd infra && pulumi config get gcp:project 2>/dev/null)
 REGION  ?= $(shell cd infra && pulumi config get gcp:region 2>/dev/null || echo us-east1)
-ZONE    ?= $(shell cd infra && pulumi config get gitea:zone 2>/dev/null || echo $(REGION)-a)
+# -b, matching the default in infra/pkg/config: us-east1 has no -a zone.
+ZONE    ?= $(shell cd infra && pulumi config get gitea:zone 2>/dev/null || echo $(REGION)-b)
 VM      ?= gitea-vm
 
 .PHONY: help
@@ -19,9 +20,11 @@ bootstrap: ## One-time project setup (run before the first `make up`)
 fmt: ## Format Go sources
 	cd infra && gofmt -w .
 
+# -o gitea-infra: Pulumi.yaml points the go runtime at this prebuilt binary, so
+#   Pulumi runs it rather than compiling. Without it preview/up fail outright.
 .PHONY: check
 check: ## Build and vet the Pulumi program, and syntax-check the shell scripts
-	cd infra && go build ./... && go vet ./...
+	cd infra && go build -o gitea-infra . && go vet ./...
 	bash -n vm/bootstrap.sh scripts/bootstrap.sh
 	@command -v shellcheck >/dev/null && shellcheck -S warning vm/bootstrap.sh scripts/bootstrap.sh || echo "shellcheck not installed -- skipped"
 

cloudbuild/infra.yaml

@@ -29,6 +29,10 @@ steps:
       - -c
       - |
         set -euo pipefail
+        # Pulumi.yaml points the go runtime at a prebuilt binary, so Pulumi
+        # runs ./gitea-infra rather than compiling the program itself.
+        go build -o gitea-infra .
+
         # Self-managed GCS backend: no external SaaS dependency, and the state
         # bucket is versioned so history is recoverable.
         pulumi login "gs://$PROJECT_ID-pulumi-state"