feat: CI support for governance_observability

[LeoRoccoBreedt]

Summary

• Adds run.sh with three labelled steps: agent tracing → use case team → data governance team
• Fixes agent_tracing.py to hard-fail on missing OPIK_WORKSPACE at module load (matches behaviour of the other two scripts)
• Adds .gitignore for generated governance_extract_*.json output files

Test plan

• Ran locally against opik-examples workspace — all three steps passed, traces visible in Opik
• CI passed against lrb/ci-workflows

🤖 Generated with Claude Code

[fschlz]

Review against current main (PR #16 merged). One blocker before this can go green.

Will fail the merged pr-test.yml dry-run job as-is

pr-test.yml runs a secrets-free dry-run job: bash run.sh with no credentials, expecting exit 0. This PR changes agent_tracing.py to:

WORKSPACE = os.environ["OPIK_WORKSPACE"]   # at module load

With no OPIK_WORKSPACE that raises KeyError on import → set -e → job fails. The description notes all three scripts hard-require creds, so the example currently has no creds-free path.

Fix: add a DRY_RUN guard to each script

agent_tracing.py, use_case_team.py, data_governance_team.py:

OPIK_WORKSPACE = os.environ.get("OPIK_WORKSPACE")
DRY_RUN = not (os.environ.get("OPIK_API_KEY") and OPIK_WORKSPACE)

When DRY_RUN, print locally and skip the Opik calls (the use-case template and other examples follow this pattern). Swap the hard os.environ["OPIK_WORKSPACE"] index for .get().

Good as-is

run.sh (set -e + export OPIK_PROJECT_NAME ✓) and the .gitignore. No .github/docs churn — clean.

Verify (no credentials)

cd use-cases/governance_observability && bash run.sh     # must exit 0
uv run ruff check . && uv run ruff format --check .

Also git rebase origin/main since the base moved.