An enterprise administrator runs a fleet of self-hosted runners on a Kubernetes cluster to handle bursty CI demand. They notice that after a job completes, leftover files, cached credentials, and tool installations from previous jobs sometimes leak into subsequent jobs on the same runner, causing intermittent build failures and a potential security concern. They want to auto-scale runners with the actions-runner-controller (ARC) so each runner processes exactly one job and is then destroyed. Which runner configuration best meets this requirement?