ci: restore scoped App token for team-memory queue

[Changyong Gong (chagong)]

Why

Reverts the token-substitution delta from #1943. A source repository's GITHUB_TOKEN is scoped to that repository; granting the source job actions: write does not authorize dispatching the coordinator workflow in microsoft/vscode-java-pack.

Change

Restore the original pinned actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 (v3) step using vars.ISSUELENS_DISPATCH_APP_CLIENT_ID and secrets.ISSUELENS_DISPATCH_APP_PRIVATE_KEY. Limit the minted token to microsoft/vscode-java-pack with Contents read and Actions write, and pass its output as dispatch-token. Remove the source job permissions added by #1943.

Only .github/workflows/team-memory-post-merge.yml changes (+12/-4). Canonical-repository/opt-in/push/default-branch gates, source main, top-level permissions: {}, concurrency, the immutable queue-action pin a81d2d96167fc0e69ac631c2edc85f858e693289, the explicit Java Pack / team-memory-coordinator.yml / main target, and the exact five-string payload remain unchanged.

Secret dependency and evidence

The coordinating session configures the public ISSUELENS_DISPATCH_APP_CLIENT_ID separately; the user will add ISSUELENS_DISPATCH_APP_PRIVATE_KEY later. This PR changes no variables, secrets, repository settings, opt-in state, or access, and does not claim live App authentication is configured in this source repository.

The coordinating session has confirmed Maven run 38035350856, attempt 3, successfully minted the target-scoped App token, dispatched, and revoked it after the user corrected the App key. Its matching Java Pack receiver run 38204425204 finished with a validated updated result. That demonstrates the authentication mechanism in Maven, not live execution from this repository. No token minting, dispatch, rerun, deployment, merge, or auto-merge was performed for this PR.

Validation

• Parsed YAML and asserted an exact inverse of ci: use built-in token for team-memory queue #1943, identical to its parent workflow, with only the requested file changed.
• Asserted all gates, immutable pins, App credential references, repository/permission scope, token-output wiring, explicit coordinator target, and exact five-string JSON payload.
• git diff --check passed; reviewed the one-file diff before committing and pushing.