Use push events for IssueLens team memory

[Changyong Gong (chagong)]

Summary

• Replace pull_request_target: closed with pushes to main, retaining required string workflow_dispatch.inputs.pull_request_number for single-PR recovery.
• Pin only the team-memory invocation to microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390, the merged adapter from Batch team-memory updates on default-branch pushes IssueLens#36. It verifies the eligible merged-PR inventory for each push, batches those PRs into at most one request, and skips pushes without eligible PRs before Azure login. No consumer checkout is added.
• Require the existing opt-in and current default-branch ref for both supported events. Key concurrency by push SHA or manual PR number, preserve the repository/prefix and cancel-in-progress: false, and increase the job timeout to 30 minutes.
• Correct the existing concurrency description only. Preserve issue-triage workflows/action pins, runner, permissions, secrets and inputs, privacy modes, wiki configuration, and substantive policies.

Operational prerequisite and scope

The existing Azure identity must trust the default-branch OIDC subject repo:microsoft/vscode-java-test:ref:refs/heads/main for push and manual-dispatch runs. A PR-scoped federation credential is not sufficient. This prerequisite was not verified or changed by this PR.

No Azure federation, secrets, variables, Actions-policy, or wiki changes were made. No live workflow dispatch, agent/runtime invocation, Foundry deployment, or merge was performed; no deployment is needed for this caller migration.

Validation

• Confirmed the live default branch is main and started from latest origin/main at 4d240c0197470e7934cd676584f2092e430bd346 (onboarding Onboard IssueLens for Java Test #1935).
• actionlint 1.7.12 passed for the modified caller. It was initially unavailable; the official release binary was downloaded into session artifacts and its SHA-256 verified against the published checksum.
• YAML 1.2 parsing preserved the on key. Scratch assertions passed for the exact action pin, push/default-branch trigger, required manual string input, 30-minute timeout, job gate, permissions, runner, secret/input wiring, privacy modes, and absence of checkout.
• All 144 enabled/disabled, default/nondefault-ref, and supported/unsupported-event gate cases passed, including a changed repository-default-branch context. Ten concurrency assertions confirmed distinct push SHAs, stable manual-PR grouping, repository isolation, and run-ID fallback.
• Full workflow comparison and exact documentation-delta checks confirmed that unrelated workflows, triage pins, wiki configuration, and substantive policies remain unchanged. git diff --check passed. Validation artifacts were not committed.

These local checks validate caller wiring, not live OIDC federation or wiki publication.