[self-care:open-source-failures] Repair GitHub App token generation in AI Credit Savings workflow

githubnext/gh-aw-cao has a recurring startup failure in `AW Optimization / AI Credit Savings`: 5 runs failed at `Generate GitHub App token`, blocking the workflow before analysis begins. The bounded snapshot supports a single actionable cluster for GitHub App credential generation in this workflow, but it does not show the underlying secret or infra reason.

**Action:** The workflow owner should repair the GitHub App token generation path for `AW Optimization / AI Credit Savings`; accept when a rerun reaches the next job step after `Generate GitHub App token` without manual intervention and the failure signature stops recurring.

Critical findings:
- Severity: P1
- Run count: 5
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33925516556
- Confidence: medium, because the bounded snapshot identifies the failing step but not the root secret/config mismatch.

Agent prompt
Assign to Copilot: Inspect the workflow and shared credential setup used by `.github/workflows/optimization-ai-credit-optimizer.lock.yml`, identify why `Generate GitHub App token` fails before the agent runs, and make the smallest safe fix that restores token generation without widening permissions or bypassing credential checks. Summarize the exact secret/config dependency, the code or workflow change made, and which rerun proves the fix.

Evidence

Representative failing runs from the bounded snapshot:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925516556
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925494263
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925480359
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925472921
- https://github.com/githubnext/gh-aw-cao/actions/runs/33921014210

Evidence-supported probable cause: the workflow's GitHub App credential generation path is misconfigured or missing required secret/material. More evidence is required to determine the exact failing input.

Bounded fix proposal: validate the workflow's existing app/token configuration and restore the expected credential path; do not replace it with broader credentials.

### Control Plane
- Correlation ID: `33929463733-189`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33929463733`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33929799469) · pi · gpt54 · 28.7 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 11:36 PM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and inspect the shared credential setup used by the “Generate GitHub App token” step. Compare the representative failing run with the workflow’s expected secret/config dependencies, then rerun the workflow. Done means the token step completes, the next job step starts without manual intervention, and the failure signature no longer recurs.

Written by the indexing model from the issue text.