found it.

xattr -dr com.apple.quarantine ~/.pulumi/bin/*

will remove the “unidentified developer flag”