[self-care:open-source-failures] Fix recurring GitHub App token startup failures in AI Credit Savings

`AW Optimization / AI Credit Savings` in `githubnext/gh-aw-cao` has failed at least five times in the last seven days at `agent` / `Generate GitHub App token`, which suggests the workflow is blocked before it can analyze targets. The bounded snapshot supports a recurring startup failure, but it does not expose whether the failure comes from missing configuration, expired credentials, or an action-level regression.

**Action:** CAO maintainers should validate the GitHub App token generation inputs and action configuration used by this workflow, then repair the failing credential path; accept when a new `AW Optimization / AI Credit Savings` run completes beyond `Generate GitHub App token` and the next snapshot shows no new enriched failures for this signature.

Agent prompt
Investigate `.github/workflows/optimization-ai-credit-optimizer.lock.yml` failures that stop at `agent` / `Generate GitHub App token`. Trace the token-generation step inputs, required secrets, and referenced action version; fix the configuration or workflow logic that prevents token creation, and add the smallest guardrail or validation that would fail earlier with a clear message if the credential path breaks again. Summarize the root cause and link one successful post-fix run.

Critical findings:
- Severity: P0 because repeated startup failure blocks the workflow before useful work starts.
- Run count: 5 enriched failures in the bounded snapshot.
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33974703601
- Probable cause: broken GitHub App token generation path; more run-level evidence is required to distinguish secret/configuration failure from action regression.
- Confidence: medium.

Observed runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/33974703601
- https://github.com/githubnext/gh-aw-cao/actions/runs/33974672497
- https://github.com/githubnext/gh-aw-cao/actions/runs/33974666980
- https://github.com/githubnext/gh-aw-cao/actions/runs/33974661736
- https://github.com/githubnext/gh-aw-cao/actions/runs/33971750970

Workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
Signature: `Generate GitHub App token`

### Control Plane
- Correlation ID: 33977404304-231
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33977404304

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33977614907) · pi · gpt54 · 16.6 AIC · ⌖ 8.61 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 4:27 PM UTC

Start with .github/workflows/optimization-ai-credit-optimizer.lock.yml and inspect the Generate GitHub App token step, its inputs, required secrets, and referenced action version. Compare the five observed runs, beginning with run 33974703601, to identify the credential-path failure. Done means a new AW Optimization / AI Credit Savings run passes that step and the next snapshot shows no new failures for this signature.

Written by the indexing model from the issue text.