Use push events for IssueLens team memory

[Changyong Gong (chagong)]

Summary

• Migrate the existing team-memory caller from pull_request_target: closed to push on main, retaining the required string workflow_dispatch input for a single merged PR.
• Pin only the team-memory action to microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390, the immutable merged commit from Batch team-memory updates on default-branch pushes IssueLens#36, following its external-caller example.
• The pinned action discovers and batches the eligible merged PRs introduced by each default-branch push into one invocation; a valid push with no merged PRs skips before Azure login. Manual dispatch remains the single-PR recovery path.
• Preserve the existing concurrency prefix and repository scope, key runs by github.event.after || inputs.pull_request_number || github.run_id, and keep cancel-in-progress: false. Require opt-in, the live default-branch ref, and a push/manual event; increase the timeout to 30 minutes.
• Preserve top-level permissions: {}, job permissions, runner, secret/input wiring, activity-only output, status-only summaries, wiki configuration and policy. No checkout is added. Issue-triage workflows and their action pins are unchanged.

Azure OIDC prerequisite and scope

The existing Azure identity must trust the default-branch OIDC subject:

repo:microsoft/vscode-java-debug:ref:refs/heads/main

This caller-only migration requires no Foundry deployment. No Azure federation, secrets, variables, Actions policy, or wiki contents were changed. No workflow dispatch, live agent invocation, deployment, or merge was performed; live OIDC readiness was not exercised.

Validation

• Parsed the actual edited YAML with on preserved as a string key and duplicate keys rejected.
• Passed exact assertions for the immutable pin, push branch filter, required manual input, gate, 30-minute timeout, permissions, secrets, privacy settings, and absence of checkout/obsolete PR-payload gates.
• Passed 180 truth-table cases evaluated from the edited gate, covering enabled/disabled/unset opt-in, default/nondefault/tag refs, alternative default branches, and supported/unsupported events.
• Passed 9 concurrency checks covering distinct push SHAs, stable groups for the same manually requested PR, different PRs, precedence, run-ID fallback, and repository isolation.
• Passed actionlint v1.7.12 on the edited workflow (session-local binary verified against the release checksum) and git diff --check.
• Self-reviewed the one-file diff and verified all triage workflows/action pins, wiki configuration and policies remain unchanged. Validation scripts are session artifacts, not committed repository tooling.