[aw-maintenance:failures-investigator] Daily Runtime Threat Scan blocked: compile-agentic version v0.83.1 is on the blocked list

### Problem

The `Daily Runtime Threat Scan` workflow in `github/gh-aw-actions` (`.github/workflows/daily-runtime-threat-scan.lock.yml`) is failing on every recent trigger during the `activation` job at the "Check compile-agentic version" step, before the agent even runs.

### Affected runs

- https://github.com/github/gh-aw-actions/actions/runs/33807348028 (2026-09-03T21:19:52Z)
- https://github.com/github/gh-aw-actions/actions/runs/33802522237 (2026-09-03T20:31:06Z)

### Root cause

Both failures show the identical error:

```
Checking compile-agentic version: v0.83.1
Fetching update configuration from: https://raw.githubusercontent.com/github/gh-aw-actions/main/.github/aw/compat.json
##[error]Blocked compile-agentic version: v0.83.1 is in the blocked versions list. Update gh-aw to the latest version and recompile your workflow.
```

The lock file was compiled with `gh-aw` v0.83.1, which is now listed in the blocked-versions compatibility config (`.github/aw/compat.json`). Because the check runs at activation time on every scheduled trigger, this will continue to fail on every run until the workflow is recompiled with a non-blocked version.

### Proposed remediation

1. Update the `gh-aw` CLI/tooling used to compile workflows in this repository to a version newer than v0.83.1 (one not present in `.github/aw/compat.json`'s blocked list).
2. Recompile `.github/workflows/daily-runtime-threat-scan.md` → `.lock.yml` with `gh aw compile` using the updated version.
3. Commit the regenerated lock file.
4. Check whether other workflows in the repository were also compiled with v0.83.1 and recompile those too if so.

### Success criteria

- A subsequent scheduled run of `Daily Runtime Threat Scan` passes the "Check compile-agentic version" activation step (no `Blocked compile-agentic version` error).
- The `GH_AW_COMPILED_VERSION` env value embedded in the lock file's activation job reflects a version not on the blocked list.

### Reference

See the failure report issue for full window analysis and the related P2 bucket: title-prefixed `[aw-maintenance:failures-investigator] Failure Report: 3 failed agentic runs in github/gh-aw-actions (24h)`.

### Control Plane
- Correlation ID: 33834075588-34
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33834075588

> Generated by [:rotating_light: AW Maintenance / Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33834417957) · copilot · auto · 23 AIC · ⌖ 12.4 AIC · ⊞ 14.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-failures-investigator%22&type=issues)
> - [x] expires on Sep 18, 2026, 3:52 AM UTC

Start with .github/workflows/daily-runtime-threat-scan.md and its generated .lock.yml, then inspect .github/aw/compat.json and the activation job's embedded version. Recompile with a newer gh-aw version and check whether other lock files use v0.83.1. Done means the regenerated workflow embeds a non-blocked version and a subsequent scheduled run passes the version check.

Written by the indexing model from the issue text.