[self-care:open-source-failures] Repair AW Doctor target authority for live-mode precompute

AW Doctor live-mode workflows in `githubnext/gh-aw-cao` are repeatedly failing before activation because target authority is missing or incomplete for the `aw-doctor` package. This is blocking multiple doctor workflows at the same gate and the bounded snapshot shows repeated recurrence within minutes.

**Action:** Repo maintainers should add or repair `target-authority.packages.aw-doctor.authority` in `.github/workflows/cao.json`; accept when new runs of AW Doctor / Upgrade, AW Doctor / Compiler Security, and AW Doctor / Failures pass `Run CAO control precompute` in live mode.

Critical findings:
- Severity: P0 because the workflows are blocked before activation.
- Affected workflows: `aw-maintenance-upgrade.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `aw-failures-investigator.lock.yml`.
- Evidence-supported cause: `Run CAO control precompute` reports either `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode` or `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`.
- Confidence: high.

Representative runs

- Upgrade: https://github.com/githubnext/gh-aw-cao/actions/runs/33956333305
- Compiler Security: https://github.com/githubnext/gh-aw-cao/actions/runs/33956328814
- Failures: https://github.com/githubnext/gh-aw-cao/actions/runs/33956319473
- Incomplete authority declaration variant: https://github.com/githubnext/gh-aw-cao/actions/runs/33956287389

Bounded fix

Update the target authority file on the default branch so it declares schema version 1 and grants live authority for the `aw-doctor` package. Re-run one workflow from each affected AW Doctor family to verify the precompute gate now authorizes live mode.

Agent prompt

Review `.github/workflows/cao.json` on the default branch and repair the `target-authority` entry for package `aw-doctor`. Ensure the file declares version 1, includes the required package authority field for live mode, and matches the control-plane expectations used by `Run CAO control precompute`. After editing, validate the JSON and confirm AW Doctor / Upgrade, AW Doctor / Compiler Security, and AW Doctor / Failures can pass precompute in live mode.

### Control Plane
- Correlation ID: `33957598166-211`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33957598166

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33957780710) · pi · gpt54 · 27.9 AIC · ⌖ 8.51 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 9:26 AM UTC

Review .github/workflows/cao.json on the default branch and compare its target-authority entry with the precompute errors. Validate the JSON, then rerun one workflow from each affected family. Done means AW Doctor / Upgrade, Compiler Security, and Failures all pass Run CAO control precompute in live mode.

Written by the indexing model from the issue text.