[self-care:open-source-failures] Fix live target-authority declarations blocking AW Doctor and Dependabot

Repeated live-mode target-authority failures in `githubnext/gh-aw-cao` are blocking AW Doctor and Dependabot workflows before activation. In the bounded snapshot, 16 runs fail with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`, and 3 additional runs fail with a closely related invalid authority declaration message for `aw-doctor`.

**Action:** CAO maintainers should fix the `target-authority` declaration on the default branch for the affected live packages and re-run one AW Doctor workflow plus the Dependabot workflow; accept when pre-activation no longer fails on target-authority validation.

Agent prompt
Update `.github/workflows/cao.json` on the default branch so the `target-authority` block is valid version 1 and grants the required live authority for `aw-doctor` and `dependabot`. Verify the schema matches current control-plane expectations, then run the narrowest validation available and confirm one AW Doctor workflow and `Dependabot / Release Trains` pass pre-activation without a target-authority error.

Critical findings:
- Severity: P1
- Repository: `githubnext/gh-aw-cao`
- Affected workflows in bounded evidence: `AW Doctor / Compiler Security`, `AW Doctor / Failures`, `AW Doctor / Upgrade`, `Dependabot / Release Trains`
- Run count in bounded snapshot: 19 related runs (16 missing-authority, 3 invalid-declaration)
- Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/33951091943 and https://github.com/githubnext/gh-aw-cao/actions/runs/33950253876
- Evidence-supported cause: missing or malformed `target-authority` declaration for live-mode packages on the target default branch
- Confidence: high

Representative run evidence

- https://github.com/githubnext/gh-aw-cao/actions/runs/33951091943 — `AW Doctor / Compiler Security` — `pre_activation` / `Run CAO control precompute` — `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- https://github.com/githubnext/gh-aw-cao/actions/runs/33951087387 — `AW Doctor / Failures` — same failure message
- https://github.com/githubnext/gh-aw-cao/actions/runs/33951082585 — `AW Doctor / Upgrade` — same failure message
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950258965 — `Dependabot / Release Trains` — same failure message
- https://github.com/githubnext/gh-aw-cao/actions/runs/33951036598 — `AW Doctor / Compiler Security` — `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950253876 — `Dependabot / Release Trains` — `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`

### Control Plane
- Correlation ID: 33952682171-207
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33952682171

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33952849105) · pi · gpt54 · 24.1 AIC · ⌖ 8.64 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 7:38 AM UTC

Start with .github/workflows/cao.json and inspect the target-authority declarations against the current control-plane expectations. Run the narrowest available validation, then verify AW Doctor / Compiler Security and Dependabot / Release Trains pass pre-activation without target-authority errors.

Written by the indexing model from the issue text.