Your platform team runs all infrastructure changes through a Terraform pipeline in Cloud Build. Auditors require that no human can directly apply changes to production, that every production apply is preceded by a reviewed plan, and that the credentials used to apply have only the permissions needed for the target resources. Developers currently trigger builds by pushing to a shared branch, and the Cloud Build service account holds Owner on the production project. Which change best satisfies all three requirements?