Summary

Resolves #163 — makes the GitHub Copilot canvas installable via apm (Agent Package Manager), following the pattern from danielmeppiel/finops-workshop linked in the issue.

What changed

• Canvas source moved from .github/extensions/ai-engineer-coach/ to .apm/extensions/ai-engineer-coach/ — the layout apm's docs require to discover and deploy a canvas package (.apm/extensions/<name>/extension.mjs).
• New root apm.yml manifest (targets: [copilot]) makes this repo installable as an apm package.
• .github/extensions/ai-engineer-coach/extension.mjs is now a one-line forwarding stub (import "../../../.apm/extensions/ai-engineer-coach/extension.mjs";). This keeps local dev/dogfooding working exactly as before (clone + npm install && npm run build, no apm dependency), while making the canonical .apm/ source the thing apm install deploys into other projects.
• README "Run as a canvas" section now leads with the one-command apm install path, keeping the manual clone+build path for contributors working on this repo directly.
• .github/dependabot.yml: added a 7-day cooldown to the npm ecosystem update block (mirroring the existing github-actions one), so Dependabot never proposes bumping to an npm version published less than a week ago. This was prompted by a local npm install 404 against a corporate npm proxy for zod@4.5.4 — a version published only a few days before this PR — because the proxy hadn't mirrored it yet.

Install path for other projects

# one-time: turn on apm's experimental canvas support
apm experimental enable canvas

# install this repo's canvas into the current project
apm install microsoft/AI-Engineering-Coach --target copilot --trust-canvas-extensions

Why the forwarding stub (vs. gitignoring .github/extensions/)

finops-workshop gitignores its deployed .github/extensions/ copy, since apm install is the only way to get the canvas there. This repo is different: its own canvas is actively dogfooded by contributors opening this repo as a GitHub Copilot app project, and the app only discovers canvases under .github/extensions/. Gitignoring that directory would break git clone + build for every contributor unless they separately install and run apm install on their own repo. The one-line stub avoids that regression while still making the .apm/ layout the canonical, apm-installable source — verified by reloading the extension in this session and confirming the canvas still opens correctly through the stub.

Verification

• npm run build, npm run typecheck, npm run lint, npm run spellcheck, npm run knip, npm run lockfile-lint, npm test, and npm run check-size all pass with the same pre-existing (unrelated) 7 test failures in github-app-analytics.test.ts that exist on main too (confirmed via git stash).
• Reloaded the live canvas extension in this session (extensions_reload) and opened the AI Engineer Coach canvas — it loads correctly through the new .github/extensions/ai-engineer-coach/extension.mjs → .apm/extensions/ai-engineer-coach/extension.mjs forwarding path.
• apm CLI itself isn't available in this sandbox, so apm install end-to-end couldn't be exercised directly; the package layout matches apm's documented .apm/ package-type contract (confirmed against microsoft/apm docs and the finops-workshop reference implementation).
• Validated .github/dependabot.yml still parses correctly after adding the cooldown block. Did not hand-edit package.json/package-lock.json to pin around the proxy 404 — the lockfile's resolved URLs would have to point at this sandbox's internal-only proxy endpoint to reflect a real install, which would break installs for every other environment (CI and contributors use the public npm registry). The cooldown is the correct, environment-agnostic fix.