[self-care:open-source-failures] Fix repeated GitHub App token bootstrap failures in AI Credit Savings workflow

The bounded seven-day snapshot shows 5 repeated failures of `Optimization / AI Credit Savings` in `githubnext/gh-aw-cao` at the `Generate GitHub App token` step, so the workflow is blocked before analysis can begin. The evidence supports a credential/bootstrap defect, not an application-level optimization bug.

**Action:** Repository maintainer should repair the workflow's GitHub App token bootstrap path or required secret/config inputs; accept when a fresh `Optimization / AI Credit Savings` run completes the `Generate GitHub App token` step and reaches agent execution.

This cluster is actionable because the same workflow failed five times at the same step in the bounded snapshot. The available snapshot does not show the underlying exception text, so the exact failing secret, app, or permission change still needs confirmation during repair.

Agent prompt
Investigate the `Optimization / AI Credit Savings` workflow in `githubnext/gh-aw-cao` and fix the repeated failure at `Generate GitHub App token`. Review the workflow source and required secret/config inputs, correct the GitHub App token generation path without expanding permissions, and verify a new run gets past token generation into the agent job.

Representative runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/33910756217
- https://github.com/githubnext/gh-aw-cao/actions/runs/33910746834
- https://github.com/githubnext/gh-aw-cao/actions/runs/33910707624

Bounded evidence

- Snapshot generated: 2026-09-04T19:58:53.598Z
- Evidence window: 168 hours
- Workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Evidenced run count for this cluster: 5
- Confidence: medium
- Probable cause: GitHub App token generation bootstrap or secret/configuration failure before agent execution

### Control Plane
- Correlation ID: 33916506448-180
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33916506448

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33916779396) · pi · gpt54 · 27.7 AIC · ⌖ 8.48 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 8:39 PM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and inspect the Generate GitHub App token step, its required secret/config inputs, and the representative failed runs. Confirm the underlying exception without expanding permissions, repair the bootstrap path, and verify a fresh Optimization / AI Credit Savings run reaches agent execution.

Written by the indexing model from the issue text.