Fix CI pytest failure, add .dockerignore, complete render.yaml

[Copilot]

CI was broken due to pytest: command not found (exit code 127) — pip install places the binary in ~/.local/bin which isn't guaranteed on $PATH in GitHub runners. Render deployment config was a stub. No .dockerignore existed, meaning Docker builds included .git, secrets templates, Terraform state, and other noise.

Changes

CI (ci.yml)

• pytest tests/ -v → python -m pytest tests/ -v — bypasses PATH resolution entirely

.dockerignore (new)

Excludes from all image builds:

• .git/, .github/, *.md, LICENSE
• .env, .env.* (secrets — !.env.example kept)
• Python/Go/C++ build artifacts and caches
• terraform/, helm/, k8s/, monitoring/ (infra-only, mounted as volumes in compose)
• OS/IDE files

render.yaml

Expanded from a 5-line stub to define all 4 Docker services with correct dockerfilePath, dockerContext, healthCheckPath, and env vars. Sensitive values (DATABASE_URL, OLLAMA_HOST) marked sync: false for secure injection via the Render dashboard.

Service	Image source	Health path
sentinel-dashboard	streamlit-dashboard/Dockerfile	/_stcore/health
sentinel-ingestion	ingestion-service/Dockerfile	/health
sentinel-drift-engine	drift-engine/Dockerfile	/health
sentinel-llm-guard	llm-guard/Dockerfile	/health