[self-care:open-source-failures] Fix repeated GitHub App token generation failures in AI Credit Savings workflow

The AI Credit Savings workflow in `githubnext/gh-aw-cao` has failed 5 times in the bounded snapshot while generating a GitHub App token, indicating a repeatable credential or installation-access problem that blocks the workflow before its core work starts. The snapshot supports the failing step but not the underlying credential error text, so the best next fix is to inspect that setup path directly and correct the App configuration or permissions.

**Action:** CAO maintainer should inspect the representative run's token-generation step and repair the GitHub App secret, key, or installation permissions used by this workflow; accept when a rerun completes past `Generate GitHub App token` and the next bounded snapshot shows no new failures with that signature.

Agent prompt
Investigate `.github/workflows/optimization-ai-credit-optimizer.lock.yml` failures in `githubnext/gh-aw-cao` where the `agent` job fails on `Generate GitHub App token`. Open the representative run, capture the exact token-generation error, verify the workflow's expected App ID, private key secret, and installation scope, then apply the smallest safe fix to restore token issuance. Validate by rerunning the workflow and confirming it passes the token-generation step.

Critical findings:
- Repository: `githubnext/gh-aw-cao`
- Workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Normalized signature: `Generate GitHub App token`
- Severity: `P1`
- Run count in bounded snapshot: `5`
- Confidence: `medium`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33947290626
- Evidence-supported cause: GitHub App token generation is failing in the agent job; app credentials or installation access may be invalid
- Proposed bounded fix: inspect the token-generation failure, correct App credentials or installation permissions, and rerun

Representative runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/33947290626
- https://github.com/githubnext/gh-aw-cao/actions/runs/33947299968
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950280310
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950288577
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950293180

### Control Plane
- Correlation ID: `33952175990-206`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33952175990

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33952364828) · pi · gpt54 · 22.7 AIC · ⌖ 8.49 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 7:27 AM UTC

Start with the representative run and `.github/workflows/optimization-ai-credit-optimizer.lock.yml`, focusing on the `agent` job's `Generate GitHub App token` step. Capture the exact failure, then verify the expected App ID, private key secret, and installation scope. Done means the workflow rerun passes token generation and the next bounded snapshot shows no matching failures.

Written by the indexing model from the issue text.