When is HTTP_RESPONSE not fired?

The HTTP_RESPONSE is triggered for egress HTTP traffic through the box. The logon VIP in an APM multi-domain configuration doesn't trigger the HTTP_RESPONSE event because it handles all responses locally. Your best bet here, unfortunately, is to layer the APM logon VIP behind an LTM VIP that can see the HTTP response traffic from the APM VIP. You'd use a very simple iRule on the LTM VIP:

when HTTP_REQUEST {
    virtual [name of APM VIP]
}
when HTTP_RESPONSE {
    HTTP::header insert Strict-Transport-Security "max-age=31708800"
}