[self-care:open-source-failures] Fix repeated GitHub App token generation failures in AI Credit Savings

`AW Optimization / AI Credit Savings` is repeatedly failing before analysis starts because the workflow cannot complete `Generate GitHub App token`. Five runs in the bounded seven-day snapshot hit the same step, so this looks like one recurring credential/bootstrap defect with direct impact on optimization coverage.

**Action:** Repository maintainers should repair the GitHub App token generation path for this workflow; accept when a new `AW Optimization / AI Credit Savings` run completes token generation and proceeds into the agent job without the same step failure.

- Repository: `githubnext/gh-aw-cao`
- Affected workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Severity: P1
- Run count in snapshot: 5
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33968777404
- Evidence-supported cause: the workflow repeatedly stops at the `Generate GitHub App token` step, indicating a failing app-auth bootstrap path
- Bounded fix: validate the workflow's app credential inputs, token-generation action usage, and any required control-plane configuration used by this step

Representative evidence

- 2026-09-05T13:23:52Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33968777404
- 2026-09-05T13:23:08Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33968741957
- 2026-09-05T13:22:55Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33968732379
- 2026-09-05T12:34:00Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33966403267
- 2026-09-05T12:33:35Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33966382081

Agent prompt
Investigate why `.github/workflows/optimization-ai-credit-optimizer.lock.yml` repeatedly fails at `Generate GitHub App token`. Check the workflow source and any referenced shared steps for incorrect inputs, missing app configuration, or incompatible action usage, make the smallest safe fix, run the narrowest validation, and confirm a fresh run gets past token generation.

### Control Plane
- Correlation ID: `33971288876-225`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: `https://github.com/githubnext/gh-aw-cao/actions/runs/33971288876`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33971527957) · pi · gpt54 · 23.7 AIC · ⌖ 8.65 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 2:26 PM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and the representative Actions run, focusing on the failing Generate GitHub App token step. Inspect any referenced shared steps, app credential inputs, token-generation action usage, and required control-plane configuration. Done means a fresh AW Optimization / AI Credit Savings run completes token generation and proceeds into the agent job.

Written by the indexing model from the issue text.