[self-care:open-source-failures] Repair missing live target authority for CAO maintenance workflows

Repeated live-mode maintenance runs in `githubnext/gh-aw-cao` are blocked before activation because target authority is missing or invalid in `.github/workflows/cao.json`. In the bounded seven-day snapshot, 12 runs across three workflows failed with the same pre-activation signature, so maintenance automation is currently not reaching agent execution.

**Action:** CAO maintainers should repair the `target-authority.packages` entries required for the affected live packages in `.github/workflows/cao.json`; accept when fresh runs of `Dependabot / Release Trains`, `AW Doctor / Upgrade`, and `AW Doctor / Compiler Security` pass `Run CAO control precompute` without target-authority errors.

Agent prompt
Update `.github/workflows/cao.json` on the default branch so it is valid version 1 target authority and grants live authority for the affected packages used by `dependabot-release-train-updater`, `aw-maintenance-upgrade`, and `aw-maintenance-compiler-security`. Validate the JSON, confirm the required `target-authority.packages..authority` fields are present, and summarize which package entries were added or corrected.

Critical findings:
- Representative failures all stop in `pre_activation` at `Run CAO control precompute`.
- Evidence-supported signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode` and `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`.
- Affected workflows in the snapshot: `Dependabot / Release Trains` (7 runs), `AW Doctor / Upgrade` (2 runs), `AW Doctor / Compiler Security` (3 runs).
- Confidence is high because the strongest runs include explicit failure messages naming the missing or invalid authority declaration.

Representative runs

- `Dependabot / Release Trains`: https://github.com/githubnext/gh-aw-cao/actions/runs/33957936352
- `Dependabot / Release Trains`: https://github.com/githubnext/gh-aw-cao/actions/runs/33957915944
- `AW Doctor / Upgrade`: https://github.com/githubnext/gh-aw-cao/actions/runs/33958954356
- `AW Doctor / Compiler Security`: https://github.com/githubnext/gh-aw-cao/actions/runs/33958965076

Bounded fix

Repair only the target-authority declaration needed for these live workflows, then rerun the affected workflows or wait for the next scheduled executions to verify pre-activation succeeds.

### Control Plane
- Correlation ID: `33960192642-214`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33960192642

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33960356265) · pi · gpt54 · 17 AIC · ⌖ 8.64 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 10:25 AM UTC

Open `.github/workflows/cao.json` and inspect its version and `target-authority.packages` entries for the affected live packages. Validate the JSON, then run or inspect `Dependabot / Release Trains`, `AW Doctor / Upgrade`, and `AW Doctor / Compiler Security`; done means `Run CAO control precompute` passes without target-authority errors.

Written by the indexing model from the issue text.