A release workflow has an unprivileged build job and a deployment job referencing an environment with required reviewers. Deployment credentials are stored as environment secrets. What does this design provide?

1. Every earlier job automatically inherits the deployment environment secrets because it shares the workflow file.
2. The build job receives every deployment secret as soon as any workflow run starts.
3. Configure the deployment job to reference the protected environment; release its environment secrets only after the protection rules permit execution.
4. The protection applies only to manual web deployments, not to jobs declaring environment in YAML.