The build runs in a clone on your box; the source never visits a hosted runner

Now the push webhook hits an exec URL. The handler clones a build container from the ci-base snapshot, POSTs the build script to its terminal, and waits on the result. The clone is copy-on-write, ready in seconds, on the bare metal server you rent. Keys live on that server. The source tree never crosses to a runner fleet. When the build finishes, the clone is deleted; the next push gets another.

Hoody's API logged that a container was created and destroyed. The commands, the artifacts, the keys: not in its view, because the proxy that served them is on your machine.