[self-care:open-source-failures] Repair recurring GitHub App token generation failures in AI Credit Savings

`githubnext/gh-aw-cao` has a recurring AI Credit Savings workflow failure before analysis begins. In the bounded seven-day snapshot, 5 runs of `AW Optimization / AI Credit Savings` failed at `Generate GitHub App token`, so the workflow cannot authenticate and proceed.

**Action:** the workflow owner should fix the GitHub App token generation path or its required configuration; accept when two consecutive `AW Optimization / AI Credit Savings` runs generate the token successfully and complete beyond that step.

Critical findings:
- Affected workflow: `AW Optimization / AI Credit Savings` (`.github/workflows/optimization-ai-credit-optimizer.lock.yml`).
- Representative failing run: https://github.com/githubnext/gh-aw-cao/actions/runs/33960637896
- Evidence-supported cause: repeated failure at the `Generate GitHub App token` step; the bounded snapshot does not identify whether the fault is app configuration, secret wiring, or workflow logic.
- Severity: P1 because the same actionable signature recurred in multiple runs.

Bounded evidence

Representative runs with the same signature:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33960637896
- https://github.com/githubnext/gh-aw-cao/actions/runs/33960623642
- https://github.com/githubnext/gh-aw-cao/actions/runs/33960556366
- https://github.com/githubnext/gh-aw-cao/actions/runs/33958018888
- https://github.com/githubnext/gh-aw-cao/actions/runs/33957966483

Observed normalized signature: `Generate GitHub App token`.

The evidence supports a recurring authentication/bootstrap problem, but not a narrower root cause. Additional diagnosis should inspect the workflow step inputs, app installation state, and required secrets without widening scope beyond this repository.

Agent prompt

Investigate the recurring `Generate GitHub App token` failure in `AW Optimization / AI Credit Savings`. Review the workflow logic and non-secret configuration that feed token generation, identify the smallest safe fix for missing or mismatched app settings, and validate by rerunning the workflow until two consecutive runs pass token generation and continue into normal analysis.

### Control Plane
- Correlation ID: `33963310924-218`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33963310924

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33963478221) · pi · gpt54 · 18 AIC · ⌖ 8.79 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 11:35 AM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and the Generate GitHub App token step, using the representative failing run as evidence. Inspect the step inputs, non-secret configuration, app installation state, and required secrets without assuming a narrower cause. Done means two consecutive AW Optimization / AI Credit Savings runs generate the token and continue beyond that step.

Written by the indexing model from the issue text.