feat: add apm (Agent Package Manager) install support

[MPV]

Description

Adds install-tool apm support for APM (Agent Package Manager) — a language-agnostic dependency manager for AI-agent context (apm.yml / apm.lock.yaml).

This is a prerequisite for adding APM support to Renovate (see renovatebot/renovate discussion #42507 and PR #44390): Renovate needs the apm CLI available in its container image to regenerate the lock file after updating dependency refs.

How it works

APM publishes self-contained native binaries on its GitHub releases as apm-linux-<arch>.tar.gz (with a .sha256 sidecar per asset). Each archive is a PyInstaller onedir bundle — an apm executable next to an _internal/ directory — wrapped in a top-level apm-linux-<arch>/ folder.

The new ApmInstallService (modeled on the existing deno/bun single-binary tools):

• downloads the arch-specific tarball (amd64 → x86_64, arm64 → arm64);
• verifies the published .sha256 checksum;
• extracts with strip: 1 so the apm binary and its sibling _internal/ land directly in the versioned tool path (keeping them adjacent, as the PyInstaller bootloader requires);
• shell-wraps the apm binary onto PATH;
• validates the install via apm --version.

Changes

• src/cli/tools/apm.ts — new ApmInstallService.
• src/cli/install-tool/index.ts — register the service in the DI container.
• src/cli/tools/index.ts — add apm to NoPrepareTools (self-contained binary; no prepare/init step).
• test/latest/Dockerfile — add an install-tool apm e2e check with a renovate: annotation (datasource=github-releases packageName=microsoft/apm).

Testing

• prettier, eslint, and tsc pass on the changed files.
• Existing unit tests pass, including the DI container spec (src/cli/install-tool/index.spec.ts).
• The Docker e2e install is wired into the latest test image and will exercise a real download/extract/link on both x86_64 and aarch64 in CI.