feat(mise): add APM CLI to the devcontainer

[DevSecNinja]

What

Adds the Agent Package Manager (apm) to the dotfiles devcontainer so every container built from ghcr.io/devsecninja/dotfiles-devcontainer can apm install AI agent primitives (e.g. DevSecNinja/ai-toolkit).

How

One line in .mise.toml:

# renovate: datasource=pypi depName=apm-cli
"pipx:apm-cli" = "0.21.0"

The Dockerfile copies .mise.toml and runs mise install during prebuild, and mise shims are on the baked ENV PATH — so apm lands in the published image and is available in every downstream devcontainer's lifecycle hooks. Version-pinned and Renovate-tracked, following the same inline # renovate: pattern already used for chezmoi in this file.

Also lists apm --version under the software manifest's Key tools (it already auto-appears in the mise ls --current section).

Why pipx, not the github binary backend

I verified this empirically before choosing:

• ubi:/github: backends extract only the apm executable from APM's release, but it's a PyInstaller bundle (apm + _internal/). The bundle's libpython3.12.so is left behind → apm --version fails with Failed to load Python shared library. (ubi is also deprecated in mise.)
• The official curl … | sh installer works but isn't version-pinned/Renovate-friendly and adds a bespoke install path.
• pipx:apm-cli (PyPI, same project — v0.21.0 matches the GitHub release) installs cleanly and apm --version → Agent Package Manager (APM) CLI version 0.21.0. It also matches the org's existing mise pipx: usage (pipx:yamllint, pipx:checkov in .github's lint.yml).

Verification

Locally, on this branch's config:

$ mise exec pipx:apm-cli@0.21.0 -- apm --version
Agent Package Manager (APM) CLI version 0.21.0

Note for reviewer

I couldn't trigger the actual devcontainer prebuild from here — please let the devcontainer-prebuild workflow build the image and confirm apm resolves in the resulting container. The mise/pipx install was verified in isolation; the only integration assumption is that prebuild's mise install picks up the new tool (same mechanism as every other tool in this file).

[DevSecNinja]

Fixed the CI failures in 6ac624f.

Root cause: mise install failed with No version is set for shim: uv. The pipx: backend shells out to uv tool install, but uv wasn't a declared tool. My earlier local verification passed only because my shell already had uv from prior uv pipx: installs — a clean environment (CI, Docker prebuild, install.sh) has no uv, so it failed. This explains all the failing jobs (Build amd64/arm64, Test Installation, Test Coder Install) — they all run mise install.

Fix: declare uv = "latest" in .mise.toml, the same way the org lint.yml provisions uv pipx:<tool>.

Verified locally with a clean mise install against the branch config:

mise uv@0.11.23 ✓ installed
mise pipx:apm-cli@0.21.0 [1/3] uv tool install apm-cli==0.21.0
 + apm-cli==0.21.0
mise pipx:apm-cli@0.21.0 ✓ installed
$ apm --version
Agent Package Manager (APM) CLI version 0.21.0