[self-care:open-source-failures] Restore live target authority for AW Doctor workflows in githubnext/gh-aw-cao

`githubnext/gh-aw-cao` has a current live-mode pre-activation blocker: 13 enriched failures in the truncated seven-day snapshot show AW Doctor and release-train workflows stopping because target authority is missing or malformed in `.github/workflows/cao.json`. The bounded evidence supports a configuration regression, not a transient runner failure.

**Action:** CAO maintainers should assign this to Copilot and restore a valid `target-authority.packages.aw-doctor.authority` declaration in `.github/workflows/cao.json`; accept when a new live AW Doctor run and `Dependabot / Release Trains` both complete pre-activation successfully.

Critical findings:
- Affected repository: `githubnext/gh-aw-cao`
- Affected workflows: `AW Doctor / Compiler Security`, `AW Doctor / Failures`, `AW Doctor / Upgrade`, and `Dependabot / Release Trains`
- Run count in bounded snapshot: 13 enriched runs
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33935460475
- Evidence-supported cause: live target authority is either absent or fails schema validation for the AW Doctor package
- Confidence: high

Agent prompt

Inspect `.github/workflows/cao.json` on the default branch and restore a valid version 1 `target-authority.packages.aw-doctor.authority` declaration for this repository's live AW Doctor workflows. Keep the change minimal, preserve fail-closed behavior for any other package, and verify the file remains valid JSON. Then explain which field was missing or malformed and why the corrected declaration satisfies live-mode precompute.

Representative evidence

- https://github.com/githubnext/gh-aw-cao/actions/runs/33935460475 — `AW Doctor / Compiler Security` — `pre_activation` / `Run CAO control precompute` — `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- https://github.com/githubnext/gh-aw-cao/actions/runs/33935455157 — `AW Doctor / Failures` — same signature
- https://github.com/githubnext/gh-aw-cao/actions/runs/33935437160 — `AW Doctor / Upgrade` — same signature
- https://github.com/githubnext/gh-aw-cao/actions/runs/33934735728 — `Dependabot / Release Trains` — same signature
- https://github.com/githubnext/gh-aw-cao/actions/runs/33935400287 — `AW Doctor / Compiler Security` — `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`

The snapshot is truncated to the newest 100 failed runs, so additional affected runs may exist outside this bounded view.

### Control Plane
- Correlation ID: `33937355490-193`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33937355490`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33937564815) · pi · gpt54 · 23 AIC · ⌖ 8.62 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:59 AM UTC

Inspect .github/workflows/cao.json first, using the representative AW Doctor run and its pre_activation message as the starting evidence. Verify the target-authority declaration against the stated version 1 and aw-doctor requirements, then validate the JSON. Done means a new live AW Doctor run and Dependabot / Release Trains both complete pre-activation successfully.

Written by the indexing model from the issue text.