Use push events for IssueLens team memory

[Changyong Gong (chagong)]

Summary

• Replace pull_request_target: closed with pushes to the live default branch, main, while preserving required string workflow_dispatch.inputs.pull_request_number for manual single-PR recovery.
• Pin only the team-memory action to microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390, the merged rollout in Batch team-memory updates on default-branch pushes IssueLens#36. Its push adapter validates the complete merged-PR inventory, makes at most one agent invocation per push batch, and skips valid pushes with no merged PRs before Azure login.
• Require the existing team-memory opt-in, the live default-branch ref, and a push or manual-dispatch event. Preserve the concurrency prefix/repository and key by push SHA, then manual PR, then run ID; keep cancellation disabled and extend the timeout to 30 minutes.
• Preserve runner, secrets, inputs, privacy settings, top-level/job permissions, issue-triage workflow and action pin, wiki mapping, and policy requirements. Correct only the existing documentation's stale concurrency description. No checkout is added.

Validation

• Existing unit suite: 58 passing before and after the change (restored missing dependencies using npm ci --ignore-scripts --no-audit --no-fund).
• actionlint 1.7.12 passes for the changed caller and unchanged IssueLens triage caller. The tool was initially unavailable; validation used the official checksum-verified portable release, outside the repository.
• YAML 1.2 parsing of the actual caller preserves on; scratch assertions verify the exact immutable pin, main event filter, required input, permissions, timeout, secrets/privacy settings, and permitted diff.
• 72 enabled/disabled/default/non-default/supported/unsupported job-condition cases and 9 concurrency assertions pass, including distinct push SHAs, stable manual-PR keys, and run-ID fallback.
• git diff --check passes; self-review confirms triage, mappings, and policy requirements remain unchanged. Validation helpers are session artifacts, not committed infrastructure.

Rollout prerequisite / scope

The Azure federated identity must cover the default-branch subject repo:microsoft/vscode-maven:ref:refs/heads/main for push and manual dispatch. Existing PR-scoped trust is not evidence that this subject is covered; federation has not been modified or live-validated here.

This is a caller-only migration and requires no Foundry deployment. No production invocation, workflow dispatch, Azure federation/secrets/variables/Actions-policy changes, wiki-content update, or merge was performed.