Security Hardening for Automated Migration Runners

Act as a DevSecOps Database Specialist. Database migrations intrinsically require highly elevated, dangerous privileges. Architect a zero-trust security perimeter specifically for the [CI_CD_RUNNER_TYPE] (e.g., GitHub Actions self-hosted runner or Jenkins worker) tasked with executing these migrations. You must mandate the integration of a [SECRET_MANAGER] (e.g., HashiCorp Vault or AWS Secrets Manager) to dynamically inject short-lived database credentials at runtime. Define a ruthless 'Least Privilege' RBAC model for the migration user ([DB_PRIVILEGES]), ensuring it mathematically possesses the rights to execute `ALTER` or `CREATE` schema statements, but is fundamentally blocked from executing a catastrophic `DROP DATABASE` or `SELECT`ing from tables containing sensitive PII. Detail the exact automation required to revoke and destroy these credentials the millisecond the CI/CD job terminates.