[self-care:open-source-failures] Fix live target-authority metadata blocking self-care maintenance workflows

Live self-care maintenance workflows in `githubnext/gh-aw-cao` are repeatedly blocked before activation because control precompute reports missing target authority for live mode. The bounded snapshot shows 19 failed runs across four workflows in the last seven days, all pointing to the same authority gate on the target repository.

**Action:** Maintainer of `githubnext/gh-aw-cao` should fix the target-authority declaration in `.github/workflows/cao.json` for the affected live packages; accept when a new live run of each listed workflow passes pre-activation without the target-authority error.

Agent prompt
Update `.github/workflows/cao.json` in `githubnext/gh-aw-cao` so it declares version 1 and includes valid `target-authority.packages` entries for the live packages behind these workflows: `aw-maintenance` (`compiler-security`, `failures-investigator`, `upgrade`) and `dependabot` (`release-train-updater`). Preserve fail-closed behavior, keep authority scoped to only the intended live packages, and validate the file shape against existing CAO policy conventions. After editing, run the narrowest available validation for workflow/policy changes and confirm new workflow runs no longer fail in `Run CAO control precompute` with a target-authority error.

Critical findings

- Severity: P0
- Repository: `githubnext/gh-aw-cao`
- Shared normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Related variant in same area: `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`
- Affected workflows:
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/dependabot-release-train-updater.lock.yml`
- Snapshot window: 168 hours ending `2026-09-05T02:33:28.811Z`
- Confidence: high
- Probable cause: target repository authority metadata for live package execution is missing or malformed.

Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33937617441
- https://github.com/githubnext/gh-aw-cao/actions/runs/33937612438
- https://github.com/githubnext/gh-aw-cao/actions/runs/33937607773
- https://github.com/githubnext/gh-aw-cao/actions/runs/33936377702
- https://github.com/githubnext/gh-aw-cao/actions/runs/33936353338

### Control Plane
- Correlation ID: `33940059951-195`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33940059951

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33940237758) · pi · gpt54 · 21.7 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 2:56 AM UTC

Start with .github/workflows/cao.json and compare its structure with existing CAO policy conventions. Add the specified live package authority entries while preserving fail-closed behavior, then run the narrowest available workflow or policy validation and confirm new runs of the four listed workflows pass pre-activation without a target-authority error.

Written by the indexing model from the issue text.