Complete procedures with a way back.

Build a one-job Linux runner with restricted repository access, an unprivileged account, verified release, minimal network, external logs, immutable updates, fork isolation, and complete post-job destruction.