[self-care:open-source-failures] Fix GitHub App token generation in AW Optimization / AI Credit Savings

`githubnext/gh-aw-cao` has a recurring token-generation failure in `AW Optimization / AI Credit Savings`: 3 runs in the truncated seven-day snapshot failed at `Generate GitHub App token`, so the optimization workflow is not reaching its analysis stage. The bounded evidence supports a workflow credential-path problem, but it does not expose whether the secret, app configuration, or calling step is at fault.

**Action:** CAO maintainers should assign this to Copilot and repair the GitHub App token generation path for `AW Optimization / AI Credit Savings`; accept when a fresh run reaches the analysis stage without failing at `Generate GitHub App token`.

Critical findings:
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflow: `AW Optimization / AI Credit Savings`
- Run count in bounded snapshot: 3
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33934878951
- Evidence-supported cause: more evidence required; the repeated failure is confined to the token-generation step
- Confidence: medium

Agent prompt

Inspect the `AW Optimization / AI Credit Savings` workflow and its token-generation step, identify why `Generate GitHub App token` is failing before analysis starts, and implement the smallest safe fix. Preserve least privilege and existing fail-closed behavior, then summarize the root cause, the change made, and how to verify the workflow now reaches analysis.

Representative evidence

- https://github.com/githubnext/gh-aw-cao/actions/runs/33934878951 — `agent` / `Generate GitHub App token`
- https://github.com/githubnext/gh-aw-cao/actions/runs/33934844988 — same signature
- https://github.com/githubnext/gh-aw-cao/actions/runs/33934800444 — same signature

The snapshot is truncated to the newest 100 failed runs, so this issue may undercount the full recurrence.

### Control Plane
- Correlation ID: `33937355490-193`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33937355490`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33937564815) · pi · gpt54 · 23 AIC · ⌖ 8.62 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:59 AM UTC

Start by inspecting the `AW Optimization / AI Credit Savings` workflow and its `Generate GitHub App token` step, using representative run 33934878951 and the two related runs. Determine whether the secret, app configuration, or calling step causes the failure, then verify a fresh run reaches the analysis stage while preserving least privilege and fail-closed behavior.

Written by the indexing model from the issue text.