[self-care:open-source-failures] CAO live-mode workflows blocked by missing target authority

Four `githubnext/gh-aw-cao` live-mode maintenance workflows failed in the last seven days before they could start work because CAO precompute reported missing target authority on the target default branch. The bounded snapshot shows this blocks repeated runs of AW Doctor maintenance and Dependabot release-train automation, making it the highest-priority untracked reliability defect in scope.

**Action:** CAO maintainers should fix live targeting so these workflows run only against repositories with valid target authority, or add the required target-authority declarations where live mode is intended; accept when a new run of each affected workflow passes pre-activation and no new failures with this signature appear in the next snapshot.

Assign to Copilot.

Agent prompt
Investigate why these live-mode workflows are dispatching against repositories that lack valid target authority, then implement the smallest safe fix. Use this evidence only:
- `githubnext/gh-aw-cao` `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `githubnext/gh-aw-cao` `.github/workflows/aw-failures-investigator.lock.yml`
- `githubnext/gh-aw-cao` `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `githubnext/gh-aw-cao` `.github/workflows/dependabot-release-train-updater.lock.yml`
- failing signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- related schema failure: `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority` and `target-authority.packages.dependabot.authority`

Tasks:
1. Find where these workflows choose live mode and target repositories.
2. Ensure dispatch/precompute fail closed before live dispatch when target authority is absent or malformed.
3. If policy expects live mode for specific repos, add or repair the required `target-authority` declarations instead of widening behavior.
4. Add or update tests for missing and malformed target-authority cases.
5. Regenerate any required workflow artifacts.

Return a concise summary, changed files, and the exact acceptance evidence.

Critical findings:
- Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/33930893795, https://github.com/githubnext/gh-aw-cao/actions/runs/33930887116, https://github.com/githubnext/gh-aw-cao/actions/runs/33930881020, https://github.com/githubnext/gh-aw-cao/actions/runs/33929240402
- Additional corroborating schema failures: https://github.com/githubnext/gh-aw-cao/actions/runs/33930820967 and https://github.com/githubnext/gh-aw-cao/actions/runs/33929246917
- Severity: P0
- Runs in cluster: 16 across four workflows with the same pre-activation cause
- Evidence-supported cause: live-mode workflows are targeting repositories without the required target-authority declaration, and in some cases with malformed package authority declarations
- Confidence: medium

Bounded evidence

Affected workflows and observed counts in the snapshot:
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`: 4 runs with `Target authority missing...` plus 1 run with malformed `aw-doctor` authority
- `.github/workflows/aw-failures-investigator.lock.yml`: 4 runs with `Target authority missing...` plus 1 run with malformed `aw-doctor` authority
- `.github/workflows/aw-maintenance-upgrade.lock.yml`: 4 runs with `Target authority missing...` plus 1 run with malformed `aw-doctor` authority
- `.github/workflows/dependabot-release-train-updater.lock.yml`: 4 runs with `Target authority missing...` plus 1 run with malformed `dependabot` authority

The snapshot is truncated to the newest 100 failed runs, so additional older occurrences may exist outside this bounded evidence.

### Control Plane
- Correlation ID: `33936079722-192`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: `https://github.com/githubnext/gh-aw-cao/actions/runs/33936079722`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33936275524) · pi · gpt54 · 34.9 AIC · ⌖ 8.65 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:34 AM UTC

Start with the four named lock workflow files and trace where live mode selects target repositories. Reproduce or inspect the missing-authority signature and the related schema failures for aw-doctor and dependabot declarations. Done means precompute fails closed for absent or malformed authority, intended declarations are valid, tests cover both cases, and required workflow artifacts are regenerated.

Written by the indexing model from the issue text.