[self-care:open-source-failures] Fix target-authority validation blocking live-mode CAO workflows in githubnext/gh-aw-cao

Live-mode CAO workflows in `githubnext/gh-aw-cao` are repeatedly blocked before activation by target-authority validation. In the bounded 7-day snapshot, 20 failures across 4 workflows stop at `Run CAO control precompute` with explicit messages that `.github/workflows/cao.json` is missing or does not declare the required package authority.

**Action:** The `githubnext/gh-aw-cao` maintainers should fix the target-authority declaration in `.github/workflows/cao.json` for the affected live packages; accept when fresh runs of the cited workflows complete past `Run CAO control precompute` without target-authority errors.

Agent prompt
Update `.github/workflows/cao.json` on the default branch so it is a valid version 1 target-authority file and includes the required `target-authority.packages` entries for the live workflows failing in this snapshot, including the dependabot package. Validate the JSON, run the narrowest relevant checks, and summarize which package authorities were added or corrected and which representative workflows should now pass precompute.

Critical findings:
- Severity: P0 because the evidence shows a startup/pre-activation block.
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33953571548
- Affected workflows:
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/dependabot-release-train-updater.lock.yml`
- Evidence-supported cause: invalid or incomplete target-authority configuration for live mode in `.github/workflows/cao.json`.
- Confidence: high.

Representative evidence

Repeated message across multiple workflows:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`

Additional corroborating message:
- `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`

Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953571548
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953563031
- https://github.com/githubnext/gh-aw-cao/actions/runs/33953550273
- https://github.com/githubnext/gh-aw-cao/actions/runs/33952507584
- https://github.com/githubnext/gh-aw-cao/actions/runs/33952496450

### Control Plane
- Correlation ID: `33956123579-210`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33956123579

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33956300121) · pi · gpt54 · 24.9 AIC · ⌖ 8.56 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 8:54 AM UTC

Start with .github/workflows/cao.json and the target-authority validation messages from representative runs 33953571548 and related runs. Check the version 1 structure and required target-authority.packages entries, including dependabot, then validate the JSON and run the narrowest relevant checks. Done means the four cited workflows pass Run CAO control precompute without target-authority errors.

Written by the indexing model from the issue text.