[self-care:open-source-failures] Fix recurring GitHub App token generation failures in AW Optimization / AI Credit Savings

`AW Optimization / AI Credit Savings` in `githubnext/gh-aw-cao` failed 5 times in the bounded seven-day snapshot at `agent / Generate GitHub App token`, blocking the workflow before the optimization logic can run. The evidence supports a recurring GitHub App token generation or configuration problem in that workflow path.

**Action:** Assign this issue to Copilot to trace the app-token setup for this workflow and repair the broken credential path; accept when a rerun of `AW Optimization / AI Credit Savings` gets past `agent / Generate GitHub App token` and reaches its analysis steps.

Representative failed runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33955492674
- https://github.com/githubnext/gh-aw-cao/actions/runs/33955465467
- https://github.com/githubnext/gh-aw-cao/actions/runs/33955446972
- https://github.com/githubnext/gh-aw-cao/actions/runs/33955421302
- https://github.com/githubnext/gh-aw-cao/actions/runs/33952586870

Evidence-supported cause: each representative run stops in the agent job at `Generate GitHub App token`. The bounded snapshot does not include the underlying token action error text, so the exact misconfiguration or permission failure still needs run-level inspection.

Proposed bounded fix: review the workflow's GitHub App token inputs, secret names, app installation scope, and any recent changes to the shared token-generation path; correct the smallest misconfiguration that consistently prevents token minting for this workflow.

Agent prompt
Diagnose the recurring `agent / Generate GitHub App token` failures in `githubnext/gh-aw-cao` for `.github/workflows/optimization-ai-credit-optimizer.lock.yml`. Start from runs 33955492674, 33955465467, 33955446972, 33955421302, and 33952586870. Inspect the GitHub App token generation path, confirm which input, secret, installation, or permission is failing, implement the smallest fix, and verify that the workflow now gets past token generation.

Cluster details

- Repository: `githubnext/gh-aw-cao`
- Workflow path: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Workflow name: `AW Optimization / AI Credit Savings`
- Severity: `P0`
- Run count in snapshot: `5`
- Confidence: `medium`
- Snapshot window: `168` hours ending `2026-09-05T08:59:06.312Z`

### Control Plane
- Correlation ID: `33958090542-212`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33958090542

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33958278120) · pi · gpt54 · 27 AIC · ⌖ 8.6 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 9:38 AM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and inspect the agent / Generate GitHub App token step in runs 33955492674, 33955465467, 33955446972, 33955421302, and 33952586870. Check the token action inputs, secret names, installation scope, permissions, and recent shared-path changes. Done means a rerun of AW Optimization / AI Credit Savings passes token generation and reaches its analysis steps.

Written by the indexing model from the issue text.