A compromised build runner may have published a malicious artifact. What response is appropriate?

1. Delete all provenance records immediately.
2. Promote all generated artifacts before investigating.
3. Stop promotion, contain affected credentials and runners, and trace artifacts and deployments using provenance.
4. Change only the build runner's display name.