A deployment must reach an internal endpoint through a controlled network path. Standard GitHub-hosted runner addresses change, and the organization does not want a very broad IP allow list. Which architecture is most suitable?

1. Limit the workflow to the default branch but leave network routing and endpoint access unchanged.
2. Store the internal endpoint in a repository variable and assume this creates a private route.
3. Keep standard hosted runners and treat one observed address as permanently assigned.
4. Place deployment on a restricted runner group with controlled egress and authorize only repositories that need that network access.