A self-hosted runner was used by an untrusted build and still contains modified tools and workspace files. The next job deploys a sensitive application. Which platform change most directly reduces this cross-job risk?

1. Shorten artifact retention and leave the runner filesystem untouched.
2. Use checkout clean: true and assume it also restores system tools modified outside the workspace.
3. Change GITHUB_WORKSPACE between jobs and treat the shared operating system as fully isolated.
4. Separate trust zones and use clean, ephemeral execution environments for sensitive workloads.