[self-care:open-source-failures] Fix missing live target authority blocking AW Doctor workflows

Repeated live-mode pre_activation failures are blocking AW Doctor workflows in `githubnext/gh-aw-cao` before any repository work starts. The bounded snapshot shows 15 runs across three workflows failing with the same target-authority error, so the highest-return fix is to correct the target authority declaration on the default branch for the `self-care` package paths these workflows need.

**Action:** CAO maintainers should fix the target authority declaration in `.github/workflows/cao.json` for the blocked live workflows; accept when fresh runs of `AW Doctor / Failures`, `AW Doctor / Compiler Security`, and `AW Doctor / Upgrade` pass the `Run CAO control precompute` step without the target-authority error.

Agent prompt
Update `.github/workflows/cao.json` on the default branch so `githubnext/gh-aw-cao` grants the required live target authority for the affected self-care/AW Doctor packages. Validate the JSON shape against the current CAO schema, ensure the required package authority entries are present under `target-authority`, and verify that the change is minimal and fail-closed. After editing, run the narrowest available validation for CAO policy and summarize which package authorities were added or corrected.

Critical findings:
- Repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Severity: P0
- Run count in bounded snapshot: 15
- Confidence: high
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33953571548

Evidence

Representative enriched runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953571548
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953563031
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953550273

Evidence-supported cause:
- `Run CAO control precompute` fails before activation/agent work with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.
- Because the failure occurs in pre_activation across multiple workflows in the same repository, the bounded evidence supports a shared control-policy/target-authority misconfiguration rather than a workflow-specific runtime problem.

Bounded fix proposal:
- Correct only the missing target-authority entries required for these AW Doctor workflows.
- Keep the change constrained to policy and validate against the current schema before merge.

### Control Plane
- Correlation ID: `33955082331-209`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33955082331

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33955259789) · pi · gpt54 · 23.3 AIC · ⌖ 8.64 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 8:31 AM UTC

Inspect .github/workflows/cao.json alongside the current CAO schema, then review the three affected workflow files and the Run CAO control precompute failure. Validate the policy with the narrowest available CAO check and confirm that fresh AW Doctor / Failures, Compiler Security, and Upgrade runs pass that step without the target-authority error.

Written by the indexing model from the issue text.