[self-care:open-source-failures] Live-mode targets fail pre-activation when target authority is missing

Repeated live-mode runs in `githubnext/gh-aw-cao` are blocked before activation because target authority is missing. In the bounded snapshot, 15 failures across 4 workflows share the same precompute error: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

**Action:** CAO maintainers should update these workflows or their enrollment/configuration so they only target repositories with valid live-mode authority, or downgrade unauthorized targets to review mode; accept when new runs of the affected workflows no longer fail in `Run CAO control precompute` for this authority error.

Agent prompt
Audit the live-mode targeting path for `Dependabot / Release Trains`, `AW Doctor / Compiler Security`, `AW Doctor / Upgrade`, and `AW Doctor / Failures`. Find where targets lacking `.github/workflows/cao.json` authority are still being selected for live mode, then implement the smallest safe fix so unauthorized targets are skipped or forced to review mode before dispatch. Preserve fail-closed behavior, add or update tests that cover unauthorized live targets, and summarize the exact acceptance signal from a rerun.

Critical findings:
- Repository: `githubnext/gh-aw-cao`
- Cluster severity: P1
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Affected workflows: `Dependabot / Release Trains`, `AW Doctor / Compiler Security`, `AW Doctor / Upgrade`, `AW Doctor / Failures`
- Run count in bounded snapshot: 15
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33963096379
- Confidence: high
- Probable cause: live-mode dispatch or enrollment includes targets without target-owned authority on the default branch.

Representative evidence

- `Dependabot / Release Trains`: https://github.com/githubnext/gh-aw-cao/actions/runs/33963096379
- `AW Doctor / Compiler Security`: https://github.com/githubnext/gh-aw-cao/actions/runs/33961619481
- `AW Doctor / Upgrade`: https://github.com/githubnext/gh-aw-cao/actions/runs/33961628215
- `AW Doctor / Failures`: https://github.com/githubnext/gh-aw-cao/actions/runs/33961636624

All enriched runs failed in job `pre_activation`, step `Run CAO control precompute`, with the same authority error string.

### Control Plane
- Correlation ID: 33967031445-221
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33967031445

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33967212452) · pi · gpt54 · 20.3 AIC · ⌖ 8.62 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 12:56 PM UTC

Start with the four affected workflows and the pre_activation job's “Run CAO control precompute” step, then trace how targets are selected for live mode. Check the target default branch for .github/workflows/cao.json authority and add or update tests for unauthorized targets. Done means affected runs no longer fail with the authority error, while unauthorized targets remain skipped or use review mode.

Written by the indexing model from the issue text.