Refer to https://docs.google.com/document/d/1gfwVdVdN54OeWzl_fiCP8ZY-Taz1lsrnTcFI1zNWNhU/edit?usp=sha ring Apex needs to respond to the failed agent-policy-check run. The Copilot-created pull request adds a workflow that attempts to apply production infrastructure during pull request validation. Which option best explains the required response? Select one answer.

The agent-policy-check failed because the workflow attempts to apply production infrastructure (terraform apply) directly from a pull request, which is a security risk. It also uses production secrets and doesn't declare a protected environment. Approving the PR because it's a draft is incorrect as the policy violation still exists and would be a security vulnerability if merged. Replacing Terraform with Kubernetes manifests doesn't address the core issue of applying infrastructure from a PR. Adding a schedule is irrelevant to the security policy violation. The correct response is to keep the policy block that prevents this action and refactor the workflow to move the terraform apply step to a separate, controlled workflow that runs only after merging to a protected branch or through a manual approval process, ensuring secure deployment practices.