[self-care:open-source-failures] Restore GitHub App token generation in AI Credit Savings workflow

`optimization-ai-credit-optimizer.lock.yml` is repeatedly failing in `githubnext/gh-aw-cao` while generating a GitHub App token. The bounded snapshot contains 8 runs with the same `agent` / `Generate GitHub App token` failure point, which makes this an actionable recurring workflow defect rather than a one-off interruption.

**Action:** CAO maintainers should inspect the AI Credit Savings workflow's app-token setup and restore a valid token-generation path; accept when a fresh run of `optimization-ai-credit-optimizer.lock.yml` reaches the analysis steps without failing at `Generate GitHub App token`.

Agent prompt

Review `.github/workflows/optimization-ai-credit-optimizer.md` and any imported shared workflow pieces that generate a GitHub App token. Identify why token generation is failing repeatedly in `githubnext/gh-aw-cao`, then prepare the smallest safe fix for credentials, permissions, or action wiring, along with validation steps showing the workflow progresses past token generation.

Critical evidence:
- Repository: `githubnext/gh-aw-cao`
- Workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925516556
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925494263
- https://github.com/githubnext/gh-aw-cao/actions/runs/33921014210
- Normalized signature: `Generate GitHub App token`
- Severity: P1
- Run count in bounded snapshot: 8
- Probable cause: token generation path is misconfigured or missing required app credentials/permissions
- Confidence: medium

Bounded evidence notes

The available snapshot does not expose the underlying secret or action error text, so the exact root cause is not proven from this worker's evidence alone. However, the repeated identical failing step is sufficient to justify a focused remediation issue.

### Control Plane
- Correlation ID: `33928821155-188`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33928821155

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33929088752) · pi · gpt54 · 25.9 AIC · ⌖ 8.51 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 11:26 PM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.md and .github/workflows/optimization-ai-credit-optimizer.lock.yml, then compare the eight cited runs at the Generate GitHub App token step. Trace any imported shared workflow pieces involved in token generation and inspect the available credential, permission, and action wiring. Done means a fresh workflow run reaches the analysis steps without failing at token generation.

Written by the indexing model from the issue text.