Harden-Runner: EDR for CI/CD Stops Supply Chain Attacks Cold