[self-care:open-source-failures] Fix repeated live-mode target authority failures in githubnext/gh-aw-cao

`githubnext/gh-aw-cao` has a repeated live-mode pre-activation failure: 19 runs across 4 workflows failed because target authority was reported missing, so these workflows are blocked before agent work starts.

**Action:** CAO maintainers should fix the live-mode target authority configuration for the affected workflows; accept when new runs of the listed workflows pass pre-activation without `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

Critical findings:
- Repository: `githubnext/gh-aw-cao`
- Severity: `P1`
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Run count in bounded snapshot: `19`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33969905786
- Probable cause: authority/configuration mismatch directly stated in run evidence
- Confidence: high

Agent prompt
Review the live-mode authority configuration for the listed workflows. Verify that the target repository default branch contains the required `.github/workflows/cao.json` target-authority declaration for the live packages these workflows invoke, and verify that the workflow/package configuration is pointing at the intended target. Make the smallest safe fix, add or correct the missing authority record if that is the source of truth, and confirm by identifying at least one fresh run per affected workflow that clears pre-activation.

Evidence

Representative runs from the bounded snapshot:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33969905786
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967257198
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967251980
- https://github.com/githubnext/gh-aw-cao/actions/runs/33968727939

The strongest evidence was the explicit failure message emitted during `pre_activation` → `Run CAO control precompute`.

### Control Plane
- Correlation ID: `33971819942-226`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33971819942`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33971980179) · pi · gpt54 · 28.8 AIC · ⌖ 8.74 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 2:35 PM UTC

Inspect the target repository’s default branch and the four listed .github/workflows/*.lock.yml files, starting with the representative pre_activation run and its “Target authority missing” evidence. Check how each workflow and package points to live mode, then verify whether .github/workflows/cao.json contains the required authority declaration. Done means fresh runs of all four workflows clear pre-activation without that error.

Written by the indexing model from the issue text.