another question (unrelated) - is it possible to generate an access key for Pulumi that isn’t associated with a specific person’s account? I’d like to create a token for our CI/CD systems to use but I don’t want to use my own personal tokens

Currently no, but "service tokens" are on the roadmap.