[self-care:open-source-failures] Fix recurring AW Doctor live-mode target-authority admission failures in githubnext/gh-aw-cao

Repeated AW Doctor live-mode runs in `githubnext/gh-aw-cao` are blocked before activation because control precompute reports missing target authority on the target default branch. The newest bounded evidence shows the same actionable signature in 13 runs across Upgrade, Compiler Security, and Failures workflows, so this is a recurring admission defect rather than a one-off run flake.

**Action:** Repository maintainers should correct the target authority declaration used by the `aw-doctor` package on the default branch and accept when a new live-mode run of each affected workflow passes pre-activation without the target-authority error.

Representative runs:
- `https://github.com/githubnext/gh-aw-cao/actions/runs/33913096610`
- `https://github.com/githubnext/gh-aw-cao/actions/runs/33913088645`
- `https://github.com/githubnext/gh-aw-cao/actions/runs/33913055484`

Critical findings:
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Severity: `P1`
- Run count in bounded snapshot: `13`
- Evidence-supported cause: live-mode admission expects a target authority declaration on the target default branch, and the bounded runs consistently fail because that declaration is missing or invalid for the package.
- Confidence: high

Agent prompt
Update the target authority configuration for `githubnext/gh-aw-cao` so the `aw-doctor` package is authorized for live mode on the default branch. Inspect `.github/workflows/cao.json`, add or correct the required `version: 1` and `target-authority.packages.aw-doctor.authority` fields, keep the rest of the policy fail-closed, and validate that the resulting config matches the package’s live-mode expectations. Do not widen scope or authorize unrelated packages. When done, explain the exact change and identify which three AW Doctor workflows should be re-run to confirm the fix.

Supporting evidence

The bounded snapshot recorded 13 matching failures in the newest 100 failed runs available. Example timestamps from the cluster:
- `2026-09-04T19:49:08Z` — AW Doctor / Failures
- `2026-09-04T19:49:02Z` — AW Doctor / Compiler Security
- `2026-09-04T19:48:37Z` — AW Doctor / Upgrade

The same repository also shows single runs with the related stricter signature `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`, which corroborates that the defect is configuration-related rather than transient infrastructure loss.

### Control Plane
- Correlation ID: `33915562891-179`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33915562891`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33915982194) · pi · gpt54 · 28.2 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 8:29 PM UTC

Start with .github/workflows/cao.json and inspect the target-authority configuration against the stated aw-doctor live-mode requirements, including version 1 and the package authority field. Re-run the affected workflows—aw-failures-investigator, aw-maintenance-compiler-security, and aw-maintenance-upgrade—and confirm each passes pre-activation without the target-authority error.

Written by the indexing model from the issue text.