[self-care:open-source-failures] Repair AW Doctor live-mode target authority admission

AW Doctor live-mode workflows in `githubnext/gh-aw-cao` are repeatedly failing before activation because control precompute cannot find target authority on the target default branch. The bounded snapshot shows 15 enriched failures across three AW Doctor workflows with the same explicit message, so this is a repo-level admission problem rather than a single transient run.

**Action:** A CAO maintainer should either restore AW Doctor live target authority in `.github/workflows/cao.json` or intentionally downgrade these workflows out of live mode; accept when fresh runs of AW Doctor / Upgrade, AW Doctor / Compiler Security, and AW Doctor / Failures each pass `Run CAO control precompute`.

Critical findings:
- Severity: P0 because the workflows are blocked before activation.
- Affected repository: `githubnext/gh-aw-cao`.
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`.
- Run count: 15 enriched failures in the bounded snapshot.
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33999614331
- Evidence-supported cause: `Run CAO control precompute` reports `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.
- Confidence: high.

Reviewer decision needed
This requires maintainer judgment because it changes live-write authority. Confirm whether the AW Doctor workflows should keep `live` mode. If yes, restore the required target-authority declaration on the default branch. If not, reduce rollout policy or worker mode ceilings so these workflows run in `review` mode instead.

Bounded fix

Inspect `.github/workflows/cao.json` on the default branch and verify that the target authority schema is present and grants the required package authority for `aw-doctor`. If the repository is intentionally self-targeting in live mode, restore the missing declaration. If live writes are no longer intended, update policy so the affected workflows stop requesting live-mode admission.

Representative runs

- AW Doctor / Compiler Security: https://github.com/githubnext/gh-aw-cao/actions/runs/33999614331
- AW Doctor / Failures: https://github.com/githubnext/gh-aw-cao/actions/runs/33999608907
- AW Doctor / Upgrade: https://github.com/githubnext/gh-aw-cao/actions/runs/33999603891
- Additional recurrence:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999599303
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999595088
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999591342
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999587717
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999583370
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999579589
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999574696
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999569598
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999564493
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999547514
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999543533
- https://github.com/githubnext/gh-aw-cao/actions/runs/33999539248

### Control Plane
- Correlation ID: 34004130135-256
- Central repository: githubnext/gh-aw-cao
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34004130135

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/34004301795) · pi · gpt54 · 30.8 AIC · ⌖ 8.65 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 20, 2026, 1:40 AM UTC

Inspect .github/workflows/cao.json and the three affected .lock.yml workflows, starting with the failing Run CAO control precompute step and representative runs. Confirm whether AW Doctor should remain in live mode, then verify that fresh runs of AW Doctor / Upgrade, Compiler Security, and Failures pass control precompute without the target-authority error.

Written by the indexing model from the issue text.