[self-care:open-source-failures] Live-mode workflows fail control precompute with missing target authority

Live-mode maintenance workflows in `githubnext/gh-aw-cao` are repeatedly failing before activation because CAO control precompute reports missing target authority on the target default branch. This is blocking every observed run in the cluster, so restoring target authority is the highest-return fix.

**Action:** CAO maintainers should verify and restore the target-owned live-mode authority path for `githubnext/gh-aw-cao`; accept when a new run of each affected workflow passes `Run CAO control precompute` without the missing-authority error.

Agent prompt
Investigate why live-mode workflows in githubnext/gh-aw-cao fail pre-activation with "Target authority missing: add .github/workflows/cao.json to the target default branch for live mode". Confirm the expected target-authority declaration on the default branch, identify why control precompute cannot resolve it for self-targeting live workflows, implement the smallest safe fix, and validate with a fresh run of the affected workflow families.

- Severity: P0
- Repository: `githubnext/gh-aw-cao`
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Affected workflows: `aw-failures-investigator`, `aw-maintenance-compiler-security`, `aw-maintenance-upgrade`, `dependabot-release-train-updater`
- Runs in bounded snapshot: 20
- Evidence-supported cause: Live-mode runs are blocked in pre-activation because target authority is not resolved on the target default branch.
- Confidence: high
- Representative runs:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967257198
- https://github.com/githubnext/gh-aw-cao/actions/runs/33969905786
- https://github.com/githubnext/gh-aw-cao/actions/runs/33967251980
- https://github.com/githubnext/gh-aw-cao/actions/runs/33971629926

Cluster evidence

The bounded snapshot contains repeated failures in the `pre_activation` job at step `Run CAO control precompute` with the same explicit message across four workflow files. Conclusion-only failures from the same workflows were not used to infer additional cause beyond recurrence.

### Control Plane
- Correlation ID: `33974240536-228`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33974240536

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33974407114) · pi · gpt54 · 20.1 AIC · ⌖ 8.55 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 3:24 PM UTC

Start by checking the target default branch for .github/workflows/cao.json and review the pre_activation job's Run CAO control precompute step in the affected workflows: aw-failures-investigator, aw-maintenance-compiler-security, aw-maintenance-upgrade, and dependabot-release-train-updater. Trace why control precompute cannot resolve the target authority for self-targeting live workflows. Done means fresh runs of each affected workflow pass that step without the missing-authority error.

Written by the indexing model from the issue text.