[self-care:open-source-failures] Fix repeated target-authority pre-activation failures in AW Doctor and Dependabot workflows

Repeated live-mode pre-activation failures are blocking four `githubnext/gh-aw-cao` workflows because target authority is missing or invalid for the addressed packages. In the bounded newest-100-run snapshot, 20 runs failed with explicit authority errors and three nearby conclusion-only failures in the same workflows are consistent corroboration.

**Action:** `githubnext/gh-aw-cao` maintainers should correct `.github/workflows/cao.json` target-authority entries for the affected live packages; accept when new runs of the listed workflows pass pre-activation without `Target authority missing` or `Target authority file must declare version 1 ... authority` errors.

Agent prompt
Update `.github/workflows/cao.json` so the target-authority declaration on the default branch includes valid version `1` metadata and the required package authority entries for the live packages used by AW Doctor and Dependabot release-train workflows. Verify the structure against the control-plane schema already used in this repository, then run the narrowest validation needed and confirm that new runs of the affected workflows no longer fail in `Run CAO control precompute` with target-authority errors.

- Repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Severity: P1
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33930893795
- https://github.com/githubnext/gh-aw-cao/actions/runs/33930887116
- https://github.com/githubnext/gh-aw-cao/actions/runs/33929246917
- Evidence-supported cause: pre-activation reports missing `.github/workflows/cao.json` live-mode authority or missing required `target-authority.packages..authority` fields.
- Bounded fix: repair only the target-authority declaration needed for the cited packages and workflows.

Bounded evidence

Explicit failure signatures observed in the snapshot:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`
- `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`

Observed run counts in the newest-100-run snapshot:
- 20 runs with explicit target-authority errors across the four workflows above
- 3 additional conclusion-only failures in the same workflows within the same burst, treated as corroborating recurrence only

Because the snapshot is truncated, older recurrences may exist but were not relied on here.

### Control Plane
- Correlation ID: `33934303686-191`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33934303686`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33934480944) · pi · gpt54 · 27.5 AIC · ⌖ 8.56 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:00 AM UTC

Start with .github/workflows/cao.json and compare its target-authority structure with the control-plane schema already used in the repository. Check the live packages used by the four listed workflow files, then run the narrowest validation available. Done means version 1 metadata and required package authority entries are valid and new runs pass pre-activation without target-authority errors.

Written by the indexing model from the issue text.