feat: add gh-aw.agent.execute OpenTelemetry span around agentic engine execution

[Copilot]

Summary

Adds an OpenTelemetry gh-aw.agent.execute span around RunWorkflowOnGitHub, the function that triggers an agentic workflow on GitHub Actions from the CLI.

Changes

New package: pkg/telemetry

• Tracer() — returns the gh-aw named tracer via the global OTel TracerProvider
• InitTracerProvider(ctx) — configures a batching OTLP HTTP TracerProvider when OTEL_EXPORTER_OTLP_ENDPOINT is set in the environment; returns a no-op shutdown function otherwise so callers can always defer shutdown(ctx) without a nil check

pkg/cli/run_workflow_execution.go

• RunWorkflowOnGitHub now starts a gh-aw.agent.execute span at its entry point and ends it (via defer) when the function returns
• Span attributes: workflow (name/ID), engine (override if any), repo (target repository)

cmd/gh-aw/main.go

• The run command's RunE calls telemetry.InitTracerProvider before dispatching the workflow; the TracerProvider is flushed and shut down when the command returns

Dependencies

• Promoted go.opentelemetry.io/otel/sdk from indirect → direct at v1.40.0
• Added go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp at v1.40.0
• Also upgraded go.opentelemetry.io/otel, otel/metric, and otel/trace from v1.39.0 → v1.40.0 to fix a PATH-hijacking vulnerability (GHSA) present in v1.39.0 of the SDK

Behaviour

Env var	Effect
OTEL_EXPORTER_OTLP_ENDPOINT unset	No-op; spans are discarded silently (global no-op provider)
OTEL_EXPORTER_OTLP_ENDPOINT=https://…	TracerProvider exports gh-aw.agent.execute spans via OTLP HTTP to the configured endpoint

Standard OTel environment variables (OTEL_EXPORTER_OTLP_HEADERS, OTEL_SERVICE_NAME, etc.) are respected automatically by the SDK.