[cao-evolution:integrity] Control-plane integrity requires attention

`cao-evolution/dashboard.json` (the CAO Evolution package's own dashboard definition) references two workflow files that do not exist and are not declared as workers anywhere in `.github/workflows/cao.json`: `.github/workflows/aw-failures-investigator.md` and `.github/workflows/aw-maintenance-compiler-security.md`. These names appear to be pre-rename leftovers — the package now declares `cao-evolution-failures-investigator` and `cao-evolution-compiler-security` as the corresponding workers, and both of those `.md`/`.lock.yml` pairs exist and are correctly bound to `shared/control.md` with matching `package`/`worker` identity. All other checked control-plane bindings (worker↔workflow mapping for every package in `cao.json`, orchestrator/worker `shared/control.md` imports, and dashboard.json worker coverage for the other 8 packages) are consistent.

**Action:** Assign this issue to Copilot to remove the two stale workflow references from `cao-evolution/dashboard.json`'s query filters, since the correctly-named `cao-evolution-failures-investigator.md` and `cao-evolution-compiler-security.md` entries already cover the same runs/outcomes. Acceptance check: `grep -rn "aw-failures-investigator\|aw-maintenance-compiler-security" cao-evolution/dashboard.json` returns nothing, and `npm run compile` and `npm run docs:build` (if dashboard schema validation runs) still succeed.

Agent prompt

In `cao-evolution/dashboard.json`, remove every array entry equal to `.github/workflows/aw-failures-investigator.md` or `.github/workflows/aw-maintenance-compiler-security.md` from the `workflow` filter lists (there are 5 occurrences across the `cao-evolution-runs` and `cao-evolution-aw-maintenance-attainment` queries, including nested `filters.workflow` arrays used by chart marks). Do not remove the correctly-named `cao-evolution-failures-investigator.md` and `cao-evolution-compiler-security.md` entries, which already reference the current, existing workflow sources. After editing, validate with:

```
grep -rn "aw-failures-investigator\|aw-maintenance-compiler-security" cao-evolution/dashboard.json
python3 -c "import json; json.load(open('cao-evolution/dashboard.json'))"
npm run compile
```

The grep should return no output and the JSON should still parse.

Evidence

Stale references (as of policy SHA `16cbf27aa6f4eaeaa93290d3b17ae1010588cf2a`):

```
cao-evolution/dashboard.json:25: ".github/workflows/aw-failures-investigator.md",
cao-evolution/dashboard.json:26: ".github/workflows/aw-maintenance-compiler-security.md"
cao-evolution/dashboard.json:68: ".github/workflows/aw-failures-investigator.md",
cao-evolution/dashboard.json:69: ".github/workflows/aw-maintenance-compiler-security.md"
cao-evolution/dashboard.json:128: ".github/workflows/aw-failures-investigator.md",
cao-evolution/dashboard.json:129: ".github/workflows/aw-maintenance-compiler-security.md"
cao-evolution/dashboard.json:173: ".github/workflows/aw-failures-investigator.md",
cao-evolution/dashboard.json:174: ".github/workflows/aw-maintenance-compiler-security.md"
cao-evolution/dashboard.json:330: ".github/workflows/aw-failures-investigator.md",
cao-evolution/dashboard.json:331: ".github/workflows/aw-maintenance-compiler-security.md"
```

Neither `aw-failures-investigator.md` nor `aw-maintenance-compiler-security.md` exists in `.github/workflows/` (checked `.md` and `.lock.yml`), and neither name appears as a `workflow` value under any package's `workers` in `.github/workflows/cao.json`. A repository-wide `git log --all --follow` for both paths found no history, confirming these are stale/renamed references rather than files removed by a recent commit.

All other verified boundaries were consistent:
- Every `workers..workflow` entry in `cao.json` for all 10 packages resolves to an existing `.md` + `.lock.yml` pair.
- Every `.md` file's `shared/control.md` import (`package`/`role`/`worker`) matches its filename and a corresponding `cao.json` worker entry, for both `orchestrator` and `worker` roles, across all packages.
- The other 8 packages' `dashboard.json` files only reference workflow files that exist and are declared in `cao.json`.
- `npm run compile` succeeded with no errors.

> Generated by [CAO Evolution / Integrity](https://github.com/githubnext/gh-aw-cao/actions/runs/35052214814) · copilot · auto · 73 AIC · ⌖ 11.7 AIC · ⊞ 12K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-integrity%22&type=issues)
> - [x] expires on Sep 30, 2026, 3:41 AM UTC

Edit cao-evolution/dashboard.json and inspect the five workflow filter lists named in the issue. First run the supplied grep and JSON parse checks; done means both stale names are absent while the correctly named workflow entries remain, and npm run compile still succeeds.

Written by the indexing model from the issue text.