[self-care:open-source-failures] Restore live target authority for recurring precompute failures in gh-aw-cao

githubnext/gh-aw-cao has a recurring live-mode precompute failure: 19 runs across 4 workflows failed with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`, which blocks work before analysis starts. The bounded snapshot supports one shared cause family: target authority for the `githubnext/gh-aw-cao` live target is missing, invalid, or not readable at precompute time.

**Action:** Maintainers should restore valid live target authority in `.github/workflows/cao.json` for the affected packages, then rerun one affected workflow; accept when precompute no longer emits the target-authority error and at least one rerun of each affected workflow reaches post-precompute steps.

Agent prompt
Assign to Copilot: Inspect `.github/workflows/cao.json` and the live target-authority declarations used by `AW Doctor / Failures`, `AW Doctor / Compiler Security`, `AW Doctor / Upgrade`, and `Dependabot / Release Trains`. Fix the minimal authority/configuration problem causing `Run CAO control precompute` to fail with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`, preserve fail-closed behavior, update any package-specific authority fields that are required, and provide a concise explanation plus the exact workflows that should be rerun to verify the fix.

Critical findings:
- Severity: P1
- Run count: 19
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33927020995
- Additional evidence: one related run on the same workflow family reported `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`, which reinforces an authority-file configuration issue rather than an isolated transient.

Evidence

Representative failing runs from the bounded snapshot:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33927020995
- https://github.com/githubnext/gh-aw-cao/actions/runs/33927013513
- https://github.com/githubnext/gh-aw-cao/actions/runs/33927005846
- https://github.com/githubnext/gh-aw-cao/actions/runs/33925354919

Evidence-supported probable cause: live-mode target authority is absent, malformed, or missing required package authority declarations during control precompute. Confidence: high.

Bounded fix proposal: correct the checked-in target-authority declaration only; do not widen mode, bypass precompute, or relax authority validation.

### Control Plane
- Correlation ID: `33929463733-189`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33929463733`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33929799469) · pi · gpt54 · 28.7 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 11:36 PM UTC

Inspect .github/workflows/cao.json and the four affected lock workflows, starting with the Run CAO control precompute step and the representative failing run. Verify the version and package authority declarations against the reported errors, then rerun each affected workflow; done means precompute no longer reports a target-authority error and each workflow reaches post-precompute steps.

Written by the indexing model from the issue text.