A self-hosted runner starts jobs normally but one workflow hangs forever

Self-hosted jobs begin hanging after a hardening change even though the runner still appears online and idle/active transitions look normal.