[self-care:open-source-failures] Restore target authority for live-mode AW Doctor and Dependabot workflows

Live-mode runs in `githubnext/gh-aw-cao` are repeatedly failing before activation because target authority for live execution is missing or malformed. Bounded evidence shows 16 recurring failures across 4 workflows, so this is blocking multiple automation paths rather than a single transient run.

**Action:** The `githubnext/gh-aw-cao` maintainer should restore a valid `.github/workflows/cao.json` target-authority declaration for the affected packages on the default branch; accept when fresh runs of the affected workflows pass `Run CAO control precompute` in live mode.

Agent prompt
Validate `.github/workflows/cao.json` on the default branch for live-mode target authority. Ensure it declares `version: 1` and the required `target-authority.packages` entries for `aw-doctor` and `dependabot`, then update the source-managed control configuration and any generated artifacts needed so live-mode workflows pass CAO control precompute. Do not widen package scope or change unrelated policy.

- Severity: P1
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33951091943
- https://github.com/githubnext/gh-aw-cao/actions/runs/33951087387
- https://github.com/githubnext/gh-aw-cao/actions/runs/33950258965
- Additional corroborating evidence:
- 3 runs reported `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`.
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`.
- Probable cause: repository target-authority configuration on the default branch is absent or does not declare the required package authority for live mode.
- Confidence: high
- Bounded fix: correct the target-authority structure for the affected packages without changing rollout scope.

### Control Plane
- Correlation ID: `33953401010-208`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33953401010

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33953558843) · pi · gpt54 · 21 AIC · ⌖ 8.47 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 7:53 AM UTC

Start with .github/workflows/cao.json and the Run CAO control precompute logs to verify the required version and package authority entries for aw-doctor and dependabot. Inspect the four affected .lock.yml workflows and any source-managed generated artifacts. Done means fresh live-mode runs pass control precompute without widening package scope.

Written by the indexing model from the issue text.