[self-care:open-source-failures] Fix live-mode target-authority declarations blocking AW Doctor and Dependabot workflows

Live-mode workflows in `githubnext/gh-aw-cao` are repeatedly failing before activation because required target-authority declarations are missing or malformed. In the bounded seven-day snapshot, this blocked 20 runs across AW Doctor and Dependabot workflows, making it the highest-severity shared defect.

**Action:** CAO maintainers should add and validate the required `target-authority.packages` entries in `.github/workflows/cao.json`; accept when fresh runs of the affected workflows complete precompute without any target-authority error.

Critical findings:
- Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/33940267555 and https://github.com/githubnext/gh-aw-cao/actions/runs/33939429479
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Evidence-supported failure signatures:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`
- `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`
- Probable cause: the target repository's live-mode authority file is either absent for some package checks or does not declare the package-specific authority fields required by precompute.
- Confidence: high.

Agent prompt
Update `.github/workflows/cao.json` in `githubnext/gh-aw-cao` so live-mode target authority is valid for both `aw-doctor` and `dependabot`. Preserve existing policy, add only the missing package authority declarations required by precompute, and verify the JSON remains schema-valid. Then explain which workflows were blocked before the fix and how the new file satisfies their package authority checks.

Bounded evidence

Observed 20 related failures in the newest-100-run snapshot:
- 18 runs with the missing-authority signature across AW Doctor and Dependabot workflows.
- 1 run with an invalid `aw-doctor` declaration signature.
- 1 run with an invalid `dependabot` declaration signature.

Representative run URLs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940267555
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940262406
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940257628
- https://github.com/githubnext/gh-aw-cao/actions/runs/33940189340
- https://github.com/githubnext/gh-aw-cao/actions/runs/33939429479

### Control Plane
- Correlation ID: `33942748065-197`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33942748065

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33942908741) · pi · gpt54 · 30.7 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 3:54 AM UTC

Start with .github/workflows/cao.json and compare its target-authority.packages entries with the required aw-doctor and dependabot declarations. Check the affected AW Doctor and Dependabot workflow files, then validate the JSON and run fresh workflows. Done means precompute completes without target-authority errors while existing policy is preserved.

Written by the indexing model from the issue text.