[self-care:open-source-failures] Fix repeated live-mode target authority failures in githubnext/gh-aw-cao maintenance workflows

Repeated live-mode runs in `githubnext/gh-aw-cao` are failing before the agent starts because CAO control precompute reports `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`. In the bounded snapshot this affected 20 runs across AW Doctor and Dependabot workflows, so the same pre-activation gate is blocking multiple maintenance paths.

**Action:** Maintainers should assign this issue to Copilot and restore target authority recognition for live mode; accept when fresh runs of every affected workflow pass `Run CAO control precompute` without the target-authority error.

Agent prompt
Investigate why live-mode CAO control precompute in `githubnext/gh-aw-cao` is rejecting the target repository with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode` even though this repository is the intended target. Check the authoritative `.github/workflows/cao.json`, the precompute logic that validates target-owned authority on the protected default branch, and any recent policy/runtime changes that could make source-managed control repositories fail authority checks. Implement the smallest safe fix, add or update regression coverage for this exact self-targeting live-mode case, and verify that these workflows get past `Run CAO control precompute`: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, and `.github/workflows/dependabot-release-train-updater.lock.yml`.

Critical findings:
- Severity: P1
- Repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Run count in bounded snapshot: 20
- Probable cause supported by evidence: live-mode target authority is not being recognized for the target default branch.
- Confidence: high

Representative runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/33922824928
- https://github.com/githubnext/gh-aw-cao/actions/runs/33922817325
- https://github.com/githubnext/gh-aw-cao/actions/runs/33922809369
- https://github.com/githubnext/gh-aw-cao/actions/runs/33920855236

Evidence summary

All enriched runs in this cluster failed in job `pre_activation`, step `Run CAO control precompute`, with the same message: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

### Control Plane
- Correlation ID: `33925597261-186`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33925597261`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33925887244) · pi · gpt54 · 31.5 AIC · ⌖ 8.64 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 10:38 PM UTC

Start with .github/workflows/cao.json and the four affected .github/workflows/*.lock.yml files, then trace the CAO control precompute logic that checks target authority on the protected default branch. Reproduce or inspect the `Run CAO control precompute` failures and add regression coverage for this self-targeting live-mode case. Done means fresh runs of all four named workflows pass that step without the target-authority error.

Written by the indexing model from the issue text.