[self-care:open-source-failures] Restore GitHub App token generation for the AI credit optimizer workflow

`githubnext/gh-aw-cao`'s AI credit optimizer is repeatedly blocked before analysis starts because the agent job fails at `Generate GitHub App token`. The bounded newest-100-run snapshot contains five runs with the same actionable step failure and no conflicting enriched evidence.

**Action:** `githubnext/gh-aw-cao` maintainers should restore the GitHub App token generation path used by the optimizer workflow; accept when a new run of `.github/workflows/optimization-ai-credit-optimizer.lock.yml` reaches post-token agent work without failing at `Generate GitHub App token`.

Agent prompt
Inspect the optimizer workflow's GitHub App authentication configuration and fix the specific token-generation precondition that is preventing `.github/workflows/optimization-ai-credit-optimizer.lock.yml` from starting agent work. Keep the change narrowly scoped to the authentication path, validate the workflow configuration, and confirm a fresh run no longer fails at `Generate GitHub App token`.

- Repository: `githubnext/gh-aw-cao`
- Affected workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Severity: P1
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33929404817
- Additional corroborating runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33929378228
- https://github.com/githubnext/gh-aw-cao/actions/runs/33929350517
- https://github.com/githubnext/gh-aw-cao/actions/runs/33929323165
- https://github.com/githubnext/gh-aw-cao/actions/runs/33929296063
- Evidence-supported cause: repeated failure at the workflow step `Generate GitHub App token`; the bounded evidence does not reveal the lower-level reason, so more maintainer-visible logs are required.
- Bounded fix: repair only the optimizer workflow's GitHub App token generation path and its required configuration.

Bounded evidence

Observed run count in the newest-100-run snapshot: 5

Observed enriched signature:
- failure job: `agent`
- failure step: `Generate GitHub App token`
- failure message: not present in the bounded evidence

Because the snapshot is truncated and lacks deeper logs, this issue intentionally stops at the evidence-supported failure boundary and does not infer a secret, permission, or infrastructure root cause.

### Control Plane
- Correlation ID: `33934303686-191`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33934303686`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33934480944) · pi · gpt54 · 27.5 AIC · ⌖ 8.56 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:00 AM UTC

Start by inspecting .github/workflows/optimization-ai-credit-optimizer.lock.yml and the representative run's agent job logs at the Generate GitHub App token step. Check the workflow's GitHub App authentication configuration and validate the workflow configuration without inferring an unsupported root cause. Done means a fresh run reaches post-token agent work without failing at that step.

Written by the indexing model from the issue text.