ci: add the apify-factory review workflow (#1182)

Lets apify-factory review pull requests here and approve the trivial
ones.

- Requesting `apify-factory` as a reviewer runs an AI review; when every
gate passes, the review finds nothing and a second model agrees, it
approves instead of commenting.
- A push that changes the code, removing the request, or going back to
draft withdraws the bot's own approval.
- This repository's `factory_auto_approve` property is true, which is
what allows approvals, and mtrunkat becomes the code owner of the
workflow file.
- These paths are never auto-approved here, on top of the defaults every
repository has. An agent proposed them from the repository's layout;
edit the list in the workflow like any other code.

| Path | Why | Files |
| --- | --- | --- |
| `src/apify/_charging.py` | Pay-per-event ChargingManager that computes
and submits charges to users against pricing info; any change can alter
what customers are billed. | 1 |
| `src/apify/_crypto.py` | RSA/AES encryption, private-key loading,
secret-input decryption and HMAC signing; subtle changes can leak
secrets or break cryptographic guarantees. | 1 |
| `.rules.md` | Instruction file for coding agents (duplicate of
CLAUDE.md) that steers automated contributors; changes to agent guidance
need human review. | 1 |

Refs
https://github.com/apify/ai-developer/blob/main/actions/auto-approve/README.md

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: apify-factory

.github/CODEOWNERS

@@ -2,3 +2,4 @@
 
 /docs/**/*.md @szaganek
 /docs/**/*.mdx @szaganek
+/.github/workflows/factory_review.yaml @mtrunkat

.github/workflows/factory_review.yaml

@@ -0,0 +1,35 @@
+name: apify-factory review (AI review, and auto-approval)
+
+# Calls the apify-factory review and auto-approval pipeline (apify/ai-developer, wired up in
+# apify/workflows). Approvals additionally need the repository's `factory_auto_approve` custom
+# property set to true.
+on:
+  # Taken from the default branch, never from the pull request, so a pull request cannot rewrite
+  # its own review pipeline. Pull request code is never checked out or executed.
+  pull_request_target:
+    types:
+      - review_requested
+      - review_request_removed
+      - converted_to_draft
+      - ready_for_review
+      - synchronize
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  factory-review:
+    uses: apify/workflows/.github/workflows/factory_review.yaml@main
+    secrets: inherit
+    # Paths never auto-approved here, on top of the pipeline's defaults. Proposed from the
+    # repository's layout when this workflow was added; edit them like any other code.
+    with:
+      policy: |
+        {
+          "denyGlobs": [
+            "src/apify/_charging.py",
+            "src/apify/_crypto.py",
+            ".rules.md"
+          ]
+        }