Use built-in token for team-memory dispatch

[Changyong Gong (chagong)]

Blocked: not merge-ready

This is a user-directed draft, not a working cross-repository dispatch replacement. The built-in github.token (GITHUB_TOKEN) is scoped to microsoft/vscode-java-dependency and has no Actions-write access to the coordinator repository, microsoft/vscode-java-pack. Granting job-level actions: write does not expand that repository scope. If merged as-is, opted-in pushes would fail to queue the Java Pack coordinator.

Java Pack's reference workflow dispatches within its own repository. Neither that same-repository configuration nor a public read diagnostic proves this caller can write to Java Pack. Keep this PR draft and do not merge or enable auto-merge; cross-repository authorization needs a separately agreed solution. This PR does not add credentials, alter the coordinator architecture, or disable the opt-in gate to conceal the blocker.

Requested change

• Remove the actions/create-github-app-token dispatcher-token step and its App credential references.
• Pass ${{ github.token }} to the existing pinned queue-team-memory action.
• Set dispatch-job permissions to contents: read and actions: write, matching Java Pack's main workflow; retain top-level permissions: {}.

Only .github/workflows/team-memory-post-merge.yml changes. The canonical source, fixed main push trigger, actual-default-branch gate, workflow-head gate, non-created/non-deleted/non-forced gates, opt-in, concurrency, runtime limits, immutable action pin, explicit Java Pack repository/workflow/main target, and exact five-string JSON payload are unchanged.

Offline checks

Passed YAML parsing with cached js-yaml@4.1.0, exact parsed-baseline comparison, pinned action input-schema checks, permissions/reference comparison, credential-reference removal checks, exact payload comparison, all eight gate clauses, and 15 gate cases (one allowed and 14 rejected). git diff --check also passed.

Reference: Java Pack main at ea2dd0e56e4c5a4710913a8b0fda5197b7e67587; pinned queue action at a81d2d96167fc0e69ac631c2edc85f858e693289. These offline checks do not prove cross-repository dispatch authorization.

No live token minting, coordinator dispatch, workflow rerun, or changes to secrets, variables, Apps, repository settings, Azure, IssueLens, deployments, or public documentation were performed. Production remains unchanged while this PR stays unmerged.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.