[aw-maintenance:failures-investigator] Blocked compile-agentic version v0.83.1 breaks Daily Runtime Threat Scan activation

**Target repository**: `github/gh-aw-actions`

**Affected workflow**: Daily Runtime Threat Scan (`.github/workflows/daily-runtime-threat-scan.lock.yml`)

**Problem**: The `activation` job fails at the "Check compile-agentic version" step with:

`##[error]Blocked compile-agentic version: v0.83.1 is in the blocked versions list. Update gh-aw to the latest version and recompile your workflow.`

**Affected runs**:
- https://github.com/github/gh-aw-actions/actions/runs/33807348028
- https://github.com/github/gh-aw-actions/actions/runs/33802522237

**Probable root cause**: The compiled lock file embeds `GH_AW_COMPILED_VERSION: v0.83.1`. The activation step fetches the update/compatibility config from `.github/aw/compat.json` and cross-checks the compiled version against a blocked-versions list. v0.83.1 is now on that list, so every scheduled/triggered run of this workflow fails deterministically at activation — this is a hard startup gate (P0), not a transient issue.

**Proposed remediation**: Update the `gh-aw` tool used to compile `.github/workflows/daily-runtime-threat-scan.md` to a version newer than v0.83.1 that is not on the blocked list, then recompile to regenerate `daily-runtime-threat-scan.lock.yml` (and check other workflows in the repository for the same pinned/blocked compiled version).

**Success criteria**: A subsequent run of the "Daily Runtime Threat Scan" workflow passes the "Check compile-agentic version" activation step (i.e., `GH_AW_COMPILED_VERSION` in the regenerated lock file is not in the blocked versions list, and the activation job succeeds).

See the failure report issue `#1127` for full evidence and bucket context.

### Control Plane
- Correlation ID: `33830504321-33`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33830504321

> Generated by [:rotating_light: AW Maintenance / Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33830815295) · copilot · auto · 32.5 AIC · ⌖ 8.59 AIC · ⊞ 14.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-failures-investigator%22&type=issues)
> - [x] expires on Sep 18, 2026, 2:53 AM UTC

Start with .github/workflows/daily-runtime-threat-scan.lock.yml and the source .github/workflows/daily-runtime-threat-scan.md; inspect the embedded compiled version and compare it with the blocked versions in .github/aw/compat.json. Recompile the workflow with a newer gh-aw version, then check other repository workflows for the same blocked version. Done means the regenerated lock file uses an allowed version and a subsequent Daily Runtime Threat Scan activation passes.

Written by the indexing model from the issue text.