A self-hosted CI runner is a credential store that also executes whatever the repository says

What a self-hosted runner executes, what it leaks, and how scope, ephemerality and fork approvals change the exposure.