feat(governance): audit pipeline — manager, console + traces sinks

Adds the audit pipeline that records governance evaluations: an
AuditManager that fans out per-evaluation records to registered sinks
(console + traces), with per-instance lifecycle (one ThreadPoolExecutor
+ atexit hook keyed via a WeakSet of live managers — same shape the
later GuardrailCompensator slice reuses).

Sinks
-----

- Console sink for local development and CLI runs.
- Traces sink that emits an OTel span per evaluation; severity is
  mapped from the matched rule's enforcement mode (audit / enforce /
  guardrail_fallback) so downstream traces UIs can filter by it.

Companion changes pulled in via the main-merge on this branch
-------------------------------------------------------------

This branch was kept in sync with main during review; the diff
therefore includes the following work that originated in other PRs and
will already be merged by the time this lands:

- Workspace hydration primitives (hydration, hydrator, registry_store,
  workspace; from PR #131).
- ``execution_source`` derived field on the runtime context (from
  PR #132).

Co-Authored-By: Aditi Kumari <aditi.kumari@uipath.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

src/uipath/runtime/governance/_audit/__init__.py

@@ -0,0 +1,12 @@
+"""Audit sink framework for governance events.
+
+Internal module. Provides a pluggable audit system that emits governance
+events to one or more sinks. The only built-in sink is ``TracesAuditSink``,
+which creates OpenTelemetry spans that uipath-core's exporter ships to the
+Orchestrator Traces UI. This sink is always registered by every
+:class:`AuditManager` and cannot be disabled by application code — it
+carries the governance audit trail.
+
+Callers import from the submodules directly (``_audit.base``, ``_audit.traces``,
+``_audit.factory``). This package exposes no aggregated symbols.
+"""