[self-care:open-source-failures] Restore live target authority for blocked self-maintenance workflows

Live-mode package runs in `githubnext/gh-aw-cao` are blocked by missing or invalid target-authority declarations, with 18 failures across four workflows in the bounded seven-day snapshot.

**Action:** CAO maintainers should correct `.github/workflows/cao.json` on the default branch so it declares version 1 and package authorities for the affected live workflows; accept when new runs of `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, `AW Doctor / Failures`, and `Dependabot / Release Trains` pass pre-activation without a target-authority error.

Critical findings:
- Representative failure: https://github.com/githubnext/gh-aw-cao/actions/runs/33940267555
- Affected workflows: `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, `AW Doctor / Failures`, `Dependabot / Release Trains`
- Evidence-supported cause: the target repository default branch lacks a valid `.github/workflows/cao.json` declaration for live-mode package authority.
- Confidence: high

Agent prompt

Update `.github/workflows/cao.json` on the default branch so it is schema-valid for version 1 and includes the required `target-authority.packages` entries for the live packages used by the failing workflows, especially `aw-doctor` and `dependabot`. Verify the fix by identifying the exact package keys referenced by those workflows, preserving existing rollout policy, and confirming that subsequent runs no longer fail in `Run CAO control precompute` with a target-authority error.

Cluster evidence

Normalized signature: `missing target authority for live mode`

Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940267555
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940262406
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940257628
- https://github.com/githubnext/gh-aw-cao/actions/runs/33939439582

Observed validation messages include:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`
- `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`

Run count in bounded snapshot: 18
Severity: P0

### Control Plane
- Correlation ID: 33941632735-196
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33941632735

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33941816468) · pi · gpt54 · 19.9 AIC · ⌖ 8.46 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 3:30 AM UTC

Start with .github/workflows/cao.json on the default branch and inspect the four affected workflows to identify their exact live package keys. Compare the file with the version-1 target-authority validation messages and representative failed run, while preserving existing rollout policy. Done means the required aw-doctor and dependabot authorities are valid and new runs pass Run CAO control precompute without target-authority errors.

Written by the indexing model from the issue text.