ci: queue team memory through Java Pack

[Changyong Gong (chagong)]

Summary

Workflow-only internal onboarding change: only .github/workflows/team-memory-post-merge.yml is modified. All documentation changes introduced by this PR have been removed; the original runtime/wiki policy is preserved.

• Replace direct team-memory invocation with the standalone queue-team-memory action pinned to a81d2d96167fc0e69ac631c2edc85f858e693289, targeting microsoft/vscode-java-pack / team-memory-coordinator.yml / main.
• Preserve ISSUELENS_TEAM_MEMORY_ENABLED and the source workflow path. Restrict dispatch to this repository's normal default-branch pushes with matching workflow/head SHAs; reject created, deleted, and forced pushes. Remove the local manual invocation path.
• Mint a dedicated dispatch App token via pinned actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 (v3.2.0), scoped only to vscode-java-pack with Contents read and Actions write. The source GITHUB_TOKEN retains no permissions.
• Send exactly five string inputs: source_repository, source_run_id, source_run_attempt, push_before, and push_after. Java Pack owns source validation, agent invocation, shared-wiki serialization, and final validation. push_before requests reconciliation from an authorized ancestor; it is not attested original-event provenance.

Issue-triage workflows and extension behavior are unchanged. This is only the Test Runner caller migration; it does not modify the coordinator or any other repository.

Validation

• The migrated workflow passed actionlint v1.7.12. The documentation-removal follow-up verifies that its workflow Git blob is unchanged.
• Eleven session-local offline contract tests passed, covering trigger/gates, pinned action input schemas, target-only credentials and permissions, the actual shared dispatcher's configuration/payload, independent target main ref, invalid-input rejection, central receiver inputs/allowlist, a fully mocked single POST, the workflow-only diff, exact pre-migration documentation restoration, and unchanged workflow migration.
• git diff --check passed; the follow-up diff was self-reviewed against the original migration and fetched main.
• No live dispatch, workflow invocation/rerun, token mint, Azure login, or agent call was used as a test.

Rollout prerequisites

Merging while the existing source opt-in is true switches subsequent eligible pushes to queue dispatch. Configure the caller credentials before merging in that case. The new caller names are proposed setup conventions, not pre-existing upstream-required configuration:

• Source variable ISSUELENS_DISPATCH_APP_CLIENT_ID and secret ISSUELENS_DISPATCH_APP_PRIVATE_KEY for a dedicated App installed on microsoft/vscode-java-pack with Contents read and Actions write. Both names were absent from the source's read-only configuration-name listings during the initial migration checks.
• Java Pack secrets ISSUELENS_SOURCE_READ_APP_CLIENT_ID and ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY for the separate read App with Actions, Contents, and Pull requests read on the allowlisted source repositories. Initial rollout checks found these central credentials missing as well. A successful coordinator run for Java Pack itself does not validate external-source authentication.

Do not reuse the hosted IssueLens App key or the coordinator's source-read key for dispatch. No live settings, variables, secrets, credentials, or opt-in values were changed by this PR.

For manual merged-PR maintenance, use Java Pack's coordinator Run workflow on main with source_repository=microsoft/vscode-java-test and the merged pull_request_number; leave automatic run/attempt/before/after inputs empty. Dispatch acknowledgement is not maintenance completion; inspect the central run, and inspect target runs before retrying an ambiguous dispatch failure.