ci: add the apify-factory review workflow

[apify-service-account]

Lets apify-factory review pull requests here and approve the trivial ones.

• Requesting apify-factory as a reviewer runs an AI review; when every gate passes, the review finds nothing and a second model agrees, it approves instead of commenting.
• A push that changes the code, removing the request, or going back to draft withdraws the bot's own approval.
• This repository's factory_auto_approve property is true, which is what allows approvals, and mtrunkat becomes the code owner of the workflow file.
• These paths are never auto-approved here, on top of the defaults every repository has. An agent proposed them from the repository's layout; edit the list in the workflow like any other code.

Path	Why	Files
skills/**	The Agent Skill shipped in the runtime image and served to coding agents as their instructions for driving the runtime; wording changes steer agents and need a person.	1
src/services/secrets.ts	Generates per-Actor RSA keys and encrypts/decrypts secret env vars and input secrets; a subtle change can leak or weaken user secrets, which a diff alone cannot prove safe.	1

Refs https://github.com/apify/ai-developer/blob/main/actions/auto-approve/README.md