feat: CI support for tracing_finetuned_models

[LeoRoccoBreedt]

Summary

• Adds run.sh — loads distilgpt2 from HuggingFace by default so CI runs without CometML registry credentials; sends real traces to Opik when OPIK_API_KEY + OPIK_WORKSPACE are set
• Introduces USE_MODEL_REGISTRY env var to explicitly opt in to downloading from the CometML Model Registry (requires COMET_API_KEY, COMET_WORKSPACE)
• Updates use_registered_model.py and tracing_finetuned_models.ipynb to use the new flag — registry metadata only attached to traces when USE_MODEL_REGISTRY=true

Test plan

• Ran locally without env vars — HuggingFace fallback, no crash
• Ran locally with OPIK_API_KEY + OPIK_WORKSPACE — traces visible in Opik
• CI passed against lrb/ci-workflows

🤖 Generated with Claude Code

[fschlz]

Review against current main (PR #16 merged) — looks good.

run.sh is correctly named (set -e + export OPIK_PROJECT_NAME ✓), and the USE_MODEL_REGISTRY flag with a HuggingFace distilgpt2 fallback means it runs creds-free — exactly what the merged secrets-free dry-run job needs.

Confirms before merge:

1. git rebase origin/main.
2. The dry-run job runs bash run.sh creds-free → loads distilgpt2 + CPU inference. Confirm it finishes under the job's timeout-minutes: 15 (torch + transformers install + model download on a cold cache is the risk).
3. uv run ruff check . && uv run ruff format --check . clean (the lint job checks format too).
4. The notebook re-save normalized some unicode escapes (arrows etc.) — harmless, just noting it in case it inflates the diff.