[self-care:open-source-failures] Repair aw-doctor target authority for live-mode AW Doctor workflows

Recurring live-mode AW Doctor runs in `githubnext/gh-aw-cao` are blocked before activation because CAO precompute cannot find valid target authority for package `aw-doctor`. In the bounded snapshot, this affected Failures, Upgrade, and Compiler Security workflows multiple times within the same hour, so the problem is actionable and recurring.

**Action:** `githubnext/gh-aw-cao` maintainers should add or repair `target-authority.packages.aw-doctor.authority` in `.github/workflows/cao.json` on the default branch; accept when a new live-mode AW Doctor run completes pre-activation without the target-authority error.

Assign to Copilot.

Agent prompt
Update `.github/workflows/cao.json` on the default branch so the target authority declaration is valid for package `aw-doctor` in live mode. Preserve existing policy, add or repair `version: 1` and `target-authority.packages.aw-doctor.authority` as required by CAO, validate the JSON, and explain the minimal change in the PR. Acceptance: rerun one AW Doctor workflow and confirm CAO control precompute no longer fails with a target-authority error.

- Severity: `P1`
- Repository: `githubnext/gh-aw-cao`
- Affected workflows:
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- Normalized signature: `pre_activation / Run CAO control precompute / target authority missing for aw-doctor live mode`
- Probable cause: missing or incomplete target authority entry for `aw-doctor` in target `.github/workflows/cao.json`
- Confidence: `high`
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33948150684
- https://github.com/githubnext/gh-aw-cao/actions/runs/33948146058
- https://github.com/githubnext/gh-aw-cao/actions/runs/33948109011

Evidence

Representative failure messages observed in the bounded snapshot:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`

Corroborating runs in the same cluster occurred repeatedly between `2026-09-05T04:48Z` and `2026-09-05T05:48Z`.

### Control Plane
- Correlation ID: `33949930283-204`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33949930283

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33950105363) · pi · gpt54 · 16.6 AIC · ⌖ 8.59 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 6:37 AM UTC

Open .github/workflows/cao.json and compare its target-authority declaration with the reported CAO error for aw-doctor. Validate the JSON and rerun one of the affected workflows, such as .github/workflows/aw-failures-investigator.lock.yml. Done means live-mode pre-activation completes without a target-authority error.

Written by the indexing model from the issue text.