Build Self-Cleaning Infrastructure Environments for Every Pull Request

Create isolated pull-request environments with stable identity, serialized state, trusted credentials, expiry leases, and cleanup that survives canceled workflows.