[self-care:open-source-failures] Fix live target-authority failures blocking AW Doctor and Dependabot workflows

A shared live-mode pre-activation failure is blocking four `githubnext/gh-aw-cao` workflows before work begins. Nineteen runs in the bounded seven-day snapshot failed with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`, which points to one control-plane configuration defect rather than independent workflow bugs.

**Action:** Repository maintainers should correct live target-authority configuration or routing for these workflows; accept when new runs of all listed workflows reach execution without the `Target authority missing` pre-activation error.

- Repository: `githubnext/gh-aw-cao`
- Affected workflows:
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/dependabot-release-train-updater.lock.yml`
- Severity: P1
- Run count in snapshot: 19
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33969905786
- Evidence-supported cause: control precompute could not validate live target authority for the target repository
- Bounded fix: verify that the target default branch contains the expected `.github/workflows/cao.json` authority declaration and that these workflows are resolving the intended target/mode pair in live mode

Representative evidence

- 2026-09-05T13:47:15Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33969905786
- 2026-09-05T12:52:06Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33967261580
- 2026-09-05T12:52:00Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33967257198
- 2026-09-05T12:51:54Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33967251980
- 2026-09-05T13:22:49Z — https://github.com/githubnext/gh-aw-cao/actions/runs/33968727939

All enriched runs share the same pre-activation message: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

Agent prompt
Identify why live-mode control precompute cannot find valid target authority for `githubnext/gh-aw-cao` in the affected workflows. Inspect the workflow sources and the effective authority declaration in `.github/workflows/cao.json`, fix the configuration so the target repository and mode resolve correctly, run the narrowest validation needed, and confirm fresh workflow runs no longer fail at `Run CAO control precompute` with `Target authority missing`.

### Control Plane
- Correlation ID: `33971288876-225`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: `https://github.com/githubnext/gh-aw-cao/actions/runs/33971288876`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33971527957) · pi · gpt54 · 23.7 AIC · ⌖ 8.65 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 2:26 PM UTC

Inspect the four listed workflow files and the effective authority declaration in .github/workflows/cao.json, starting with how the target repository and live mode are resolved during control precompute. Run the narrowest available validation, then confirm fresh runs of all four workflows reach execution without the `Target authority missing` error.

Written by the indexing model from the issue text.