Use push events for IssueLens team memory

[Changyong Gong (chagong)]

Summary

• Replace the team-memory caller's pull_request_target: closed trigger with push on the live default branch, main, and retain required string workflow_dispatch.inputs.pull_request_number for single-PR recovery.
• Adopt merged Batch team-memory updates on default-branch pushes IssueLens#36 by pinning only the team-memory invocation to microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390.
• The pinned action validates the complete merged-PR inventory introduced by each push and submits at most one batched agent invocation. Valid pushes with no eligible merged PRs skip before Azure login; manual recovery continues to process one merged PR.
• Require explicit opt-in, the current default-branch ref, and an allowed event. Use the existing repository-specific concurrency prefix with github.event.after || inputs.pull_request_number || github.run_id, keep cancel-in-progress: false, and allow a 30-minute job timeout.
• Correct the existing team-memory documentation's stale concurrency explanation. No new documentation or test infrastructure is committed.

The Ubuntu runner, secret names, action inputs, activity output / status summary, wiki mapping and maintenance safeguards are unchanged. Top-level permissions remain {}; job permissions remain contents: read, pull-requests: read, and id-token: write. Issue-triage workflows and their action pins are unchanged. No consumer checkout or local action is added.

Operational prerequisite and boundaries

Before enabling or relying on this caller, confirm that the existing Azure OIDC federation accepts the default-branch subject repo:microsoft/vscode-java-dependency:ref:refs/heads/main for push and manual dispatch (including any repository-specific subject customization). A PR-scoped credential alone is insufficient. Federation was not inspected or changed by this PR.

No Foundry deployment is required. This change does not modify Azure federation, secrets, repository variables, Actions policies, or wiki content, and does not dispatch workflows or invoke the live IssueLens agent.

Validation

• actionlint 1.7.12 passed on the actual caller. The existing command was attempted first; the missing tool was downloaded into session artifacts and its release checksum verified.
• Session-only assertions using an on-preserving YAML parser and GitHub's @actions/expressions evaluator passed: exact triggers, main, manual input, immutable pin, permissions, timeout, runner, preserved inputs/output/privacy, and complete caller comparison against the fetched default baseline.
• 350 gate matrix cases plus missing-variable cases passed, covering disabled opt-in, nondefault refs, unsupported events, push, and manual dispatch.
• Actual concurrency-expression checks passed: distinct push SHAs remain distinct, repeated manual runs for the same PR share a key, and run-ID fallback and repository isolation are preserved.
• git diff --check and self-review passed; only the caller and its stale concurrency note changed. No live invocation, Azure login, deployment, or wiki publication was tested.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.