[self-care:open-source-failures] Restore live-mode target authority for self-targeted maintenance workflows

Live-mode self-targeted workflows in `githubnext/gh-aw-cao` are repeatedly failing before activation because control precompute reports `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`. The bounded snapshot shows 24 corroborating failures across four workflows, so this is currently blocking a shared class of live-mode maintenance runs.

**Action:** A `githubnext/gh-aw-cao` maintainer should verify and restore the target-authority declaration on the repository default branch for these live-mode workflows; accept when a fresh run of each affected workflow passes pre-activation without the target-authority error.

Agent prompt
Confirm why live-mode self-targeted workflows in `githubnext/gh-aw-cao` cannot resolve target authority from `.github/workflows/cao.json` on the default branch. Compare the checked-in authority declaration used by control precompute with the expected live-mode target-authority shape, fix the minimal configuration or compilation source needed so the default branch exposes valid authority for `AW Doctor / Failures`, `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, and `Dependabot / Release Trains`, then validate by rerunning or dry-running the relevant control-precompute path and summarize the exact fix.

- Severity: P0
- Repository: `githubnext/gh-aw-cao`
- Affected workflows: `AW Doctor / Failures`, `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, `Dependabot / Release Trains`
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Evidence-supported cause: pre-activation could not find valid target authority for live mode on the target default branch
- Confidence: high
- Bounded fix: restore or correct the target-authority declaration consumed by CAO control precompute; do not widen workflow scope beyond the existing target
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967261580
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967257198
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967251980
- https://github.com/githubnext/gh-aw-cao/actions/runs/33966283980

Cluster evidence

The bounded snapshot associated 24 failures with the same message across these workflow paths:
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/dependabot-release-train-updater.lock.yml`

The newest 100 failed runs were the only available evidence, so earlier matching failures outside that bound were not analyzed.

### Control Plane
- Correlation ID: `33968901094-223`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33968901094

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33969046593) · pi · gpt54 · 26.1 AIC · ⌖ 8.71 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:35 PM UTC

Start with .github/workflows/cao.json and compare its checked-in authority declaration with the live-mode shape expected by control precompute. Review the four affected lock workflows and the control-precompute path, then validate that fresh runs pass pre-activation without the target-authority error.

Written by the indexing model from the issue text.