ci: add the apify-factory review workflow (#2329)

Lets apify-factory review pull requests here and approve the trivial
ones.

- Requesting `apify-factory` as a reviewer runs an AI review; when every
gate passes, the review finds nothing and a second model agrees, it
approves instead of commenting.
- A push that changes the code, removing the request, or going back to
draft withdraws the bot's own approval.
- This repository's `factory_auto_approve` property is true, which is
what allows approvals, and mtrunkat becomes the code owner of the
workflow file.
- These paths are never auto-approved here, on top of the defaults every
repository has. An agent proposed them from the repository's layout;
edit the list in the workflow like any other code.

| Path | Why | Files |
| --- | --- | --- |
| `.rules.md` | Instruction file for coding agents (mirrors CLAUDE.md);
changes steer automated agents and must be reviewed by a person. | 1 |
| `src/crawlee/_utils/resources/public_suffix_list.dat` | Vendored
Public Suffix List snapshot that should change only via
scripts/update_public_suffix_list.py; hand edits can't be verified from
the diff. | 1 |
| `website/versioned_docs/**/api-typedoc.json` | Generated API reference
snapshots for released doc versions; they should change only through the
doc generator, never by hand. | 2 |

Refs
https://github.com/apify/ai-developer/blob/main/actions/auto-approve/README.md

Author: apify-service-account

.github/CODEOWNERS

@@ -2,3 +2,4 @@
 
 /docs/*.md @TC-MO
 /docs/*.mdx @TC-MO
+/.github/workflows/factory_review.yaml @mtrunkat

.github/workflows/factory_review.yaml

@@ -0,0 +1,34 @@
+name: apify-factory review (AI review, and auto-approval)
+
+# Calls the review and auto-approval pipeline in apify/ai-developer. Approvals additionally need the
+# repository's `factory_auto_approve` custom property set to true.
+on:
+  # Taken from the default branch, never from the pull request, so a pull request cannot rewrite
+  # its own review pipeline. Pull request code is never checked out or executed.
+  pull_request_target:
+    types:
+      - review_requested
+      - review_request_removed
+      - converted_to_draft
+      - ready_for_review
+      - synchronize
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  factory-review:
+    uses: apify/ai-developer/.github/workflows/_factory_review.yaml@main
+    secrets: inherit
+    # Paths never auto-approved here, on top of the pipeline's defaults. Proposed from the
+    # repository's layout when this workflow was added; edit them like any other code.
+    with:
+      policy: |
+        {
+          "denyGlobs": [
+            ".rules.md",
+            "src/crawlee/_utils/resources/public_suffix_list.dat",
+            "website/versioned_docs/**/api-typedoc.json"
+          ]
+        }