A trusted CI workflow deploys Foundry infrastructure. The organization wants to avoid long-lived stored application secrets. Which approach fits?

1. A model output used as an Azure credential
2. A public Global Administrator password in the workflow
3. Anonymous Azure resource mutation
4. Workload identity federation with constrained trust and scoped roles