Your team runs CI builds on GitHub Actions using a pool of persistent self-hosted runners hosted on Azure VMs. You notice that build reliability is degrading: leftover files, cached dependencies, and environment variables from previous jobs occasionally corrupt subsequent builds. Security also flags that a compromised job could persist malware on a runner for later jobs. You want a solution that gives each job a clean environment and auto-scales with demand, while minimizing manual VM maintenance. What should you implement?