feat(apm): activate apm-sync on the .github consumer

.github/workflows/apm-sync-caller.yml

@@ -0,0 +1,42 @@
+---
+name: APM Sync
+
+# Keeps this repo's installed APM primitives (from DevSecNinja/ai-toolkit,
+# declared in apm.yml) up to date via the central reusable workflow. On a
+# weekly schedule (or manual dispatch) it runs `apm update` and opens a
+# `chore: sync APM primitives` PR when an upstream package shipped changes.
+#
+# This is the agentic-primitive counterpart to config-sync. Branch protection
+# is respected end-to-end — the PR is opened by the App so required CI fires.
+#
+# Onboarding guide:
+#   docs/apm-sync-onboarding.md
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: apm-sync
+  cancel-in-progress: false
+
+jobs:
+  apm-sync:
+    # Self-reference: same repo, pinned to the v1.8.0 tag SHA that introduced
+    # the apm-sync reusable. Re-pin to the next vX.Y.Z tag once cut.
+    uses: DevSecNinja/.github/.github/workflows/apm-sync.yml@7f2abdd838a855dba31a2b2de6358529fdcef09d # v1.8.0
+    permissions:
+      contents: write
+      pull-requests: write
+    with:
+      # The reusable installs the apm CLI from the official aka.ms installer,
+      # which pulls the microsoft/apm GitHub release.
+      # renovate: datasource=github-releases depName=microsoft/apm
+      apm-version: "0.21.0"
+      app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
+    secrets:
+      app-private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}