Split triggers-events-wg into members and leads; add tsarlandie-oai (#215)

Working group members should be able to push branches to
experimental-ext-triggers-events and open pull requests from them, without
being able to approve or administer the repository. Today the single
triggers-events-wg team holds admin, so any new member would get all of that.

Follow the ext-skills pattern. Add a triggers-events-wg-leads team nested under
triggers-events-wg and give it admin. Drop triggers-events-wg to push. The two
current members become leads, so their access does not change.

Add tsarlandie-oai as a working group member.

The repository's CODEOWNERS must name the leads team for this to take full
effect. That is a separate change in that repository.

Author: pja-ant

src/config/repoAccess.ts

@@ -430,7 +430,8 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     teams: [
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'moderators', permission: 'maintain' },
-      { team: 'triggers-events-wg', permission: 'admin' },
+      { team: 'triggers-events-wg', permission: 'push' },
+      { team: 'triggers-events-wg-leads', permission: 'admin' },
     ],
   },
   {

src/config/roleIds.ts

@@ -57,6 +57,7 @@ export const ROLE_IDS = {
   AUTH_FINE_GRAINED_AUTHZ_WG: 'auth-wg-fine-grained-authz',
   TRANSPORT_WG: 'transport-wg',
   TRIGGERS_EVENTS_WG: 'triggers-events-wg',
+  TRIGGERS_EVENTS_WG_LEADS: 'triggers-events-wg-leads',
   MCP_APPS_WG: 'mcp-apps-wg',
   SERVER_CARD_WG: 'server-card-wg',
   INTERCEPTORS_WG: 'interceptors-wg',

src/config/roles.ts

@@ -340,6 +340,11 @@ export const ROLES: readonly Role[] = [
     github: { team: 'triggers-events-wg', parent: ROLE_IDS.WORKING_GROUPS },
     discord: { role: 'triggers & events working group (synced)' },
   },
+  {
+    id: ROLE_IDS.TRIGGERS_EVENTS_WG_LEADS,
+    description: 'Triggers & Events Working Group leads',
+    github: { team: 'triggers-events-wg-leads', parent: ROLE_IDS.TRIGGERS_EVENTS_WG },
+  },
   {
     id: ROLE_IDS.MCP_APPS_WG,
     description: 'MCP Apps Working Group',

src/config/users.ts

@@ -155,7 +155,11 @@ export const MEMBERS: readonly Member[] = [
     // Google returns 400 on refresh of this user since 2026-10-05 (deploy runs
     // #289/#290); the account is active and managed outside Pulumi.
     existingGWSUser: true,
-    memberOf: [ROLE_IDS.CORE_MAINTAINERS, ROLE_IDS.TRIGGERS_EVENTS_WG],
+    memberOf: [
+      ROLE_IDS.CORE_MAINTAINERS,
+      ROLE_IDS.TRIGGERS_EVENTS_WG,
+      ROLE_IDS.TRIGGERS_EVENTS_WG_LEADS,
+    ],
   },
   {
     github: 'cliffhall',
@@ -799,6 +803,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.SKILLS_OVER_MCP_WG_LEADS,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TRIGGERS_EVENTS_WG,
+      ROLE_IDS.TRIGGERS_EVENTS_WG_LEADS,
       ROLE_IDS.AGENTS_WG,
     ],
   },
@@ -981,6 +986,11 @@ export const MEMBERS: readonly Member[] = [
     discord: '1059910719124013168',
     memberOf: [ROLE_IDS.RUBY_SDK],
   },
+  {
+    github: 'tsarlandie-oai',
+    discord: '1516121882297106487',
+    memberOf: [ROLE_IDS.TRIGGERS_EVENTS_WG],
+  },
   {
     github: 'tzolov',
     discord: '1097924660055777290',