[self-care:open-source-failures] Fix repeated GitHub App token generation failures in AW Optimization / AI Credit Savings

`AW Optimization / AI Credit Savings` is repeatedly failing while generating a GitHub App token in `githubnext/gh-aw-cao`, preventing the workflow from reaching its analysis stage. The bounded snapshot shows multiple runs with the same actionable step-level signature, making this a recurring P1 defect.

**Action:** CAO maintainers should inspect the app-auth configuration used by `AW Optimization / AI Credit Savings` and repair the failing token generation path; accept when a new run reaches the agent work without failing at `Generate GitHub App token`.

Critical findings:
- Severity: P1
- Normalized signature: `Generate GitHub App token`
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflow: `AW Optimization / AI Credit Savings`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/34063942418
- Confidence: medium-high

Agent prompt
Investigate repeated `Generate GitHub App token` failures in `AW Optimization / AI Credit Savings` for `githubnext/gh-aw-cao`. Review the workflow's app-auth inputs, secret names, and any recent changes to token generation helpers, implement the smallest safe fix to restore token issuance, and validate by rerunning the workflow until it proceeds past token generation.

Evidence

Representative runs in the bounded snapshot:
- https://github.com/githubnext/gh-aw-cao/actions/runs/34063942418
- https://github.com/githubnext/gh-aw-cao/actions/runs/34063933657
- https://github.com/githubnext/gh-aw-cao/actions/runs/34063908148
- https://github.com/githubnext/gh-aw-cao/actions/runs/34063903120
- https://github.com/githubnext/gh-aw-cao/actions/runs/34061022960

Probable cause supported by evidence: the workflow is failing during GitHub App authentication setup. The exact misconfiguration is not evidenced in the bounded snapshot and needs targeted inspection.

### Control Plane
- Correlation ID: `34064919273-314`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34064919273

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/34065100762) · pi · gpt54 · 19.8 AIC · ⌖ 8.55 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 20, 2026, 10:54 PM UTC

Start with the AW Optimization / AI Credit Savings workflow and the representative failed run, then inspect its GitHub App authentication inputs, secret names, and token-generation helpers. Compare the repeated Generate GitHub App token failures and rerun the workflow after the smallest safe fix. Done means a new run reaches the agent work without failing at token generation.

Written by the indexing model from the issue text.