A production container has no shell or diagnostic utilities. The application must remain running while an authorized developer investigates its network namespace. Which Kubernetes capability supports adding a temporary debugging container to that Pod?

1. An ephemeral container through kubectl debug
2. A ConfigMap containing the word shell
3. A replacement namespace with the same labels
4. Editing the running container image in the Pod specification