[self-care:open-source-failures] Restore target authority for blocked live maintenance workflows in githubnext/gh-aw-cao

Repeated live-mode workflow failures in `githubnext/gh-aw-cao` are blocked before activation because CAO control precompute reports missing target authority. The bounded snapshot shows this actionable signature recurring across AW Doctor and Dependabot workflows, so live maintenance work is currently not starting for this repository.

**Action:** CAO maintainers should fix the live target-authority configuration for `githubnext/gh-aw-cao` and accept when a rerun of an affected workflow passes `Run CAO control precompute` without `Target authority missing`.

Critical findings:
- Severity: P1 because the same actionable signature recurred in multiple runs.
- Affected workflows in the snapshot: `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, `AW Doctor / Failures`, and `Dependabot / Release Trains`.
- Normalized signature: `Run CAO control precompute` → `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.
- Evidence supports a target-authority configuration problem; the bounded snapshot does not establish whether the file is missing, on the wrong branch, or unreadable to the workflow.

Recommended bounded fix

Verify that `githubnext/gh-aw-cao` default branch contains the expected `.github/workflows/cao.json` target-authority declaration for the live packages these workflows use, then rerun one affected AW Doctor workflow and one affected Dependabot workflow.

Representative runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/34010032050
- https://github.com/githubnext/gh-aw-cao/actions/runs/34010027871
- https://github.com/githubnext/gh-aw-cao/actions/runs/34010010025
- https://github.com/githubnext/gh-aw-cao/actions/runs/34006788285

Agent prompt
Audit the live target-authority setup for `githubnext/gh-aw-cao`. Confirm whether the default branch contains the correct `.github/workflows/cao.json` declaration for the live packages used by AW Doctor and Dependabot Release Trains. If it is missing or incorrect, prepare the minimal fix, explain why it restores CAO admission, and list the exact workflows to rerun for verification.

### Control Plane
- Correlation ID: `34011290070-262`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34011290070

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/34011469723) · pi · gpt54 · 16.5 AIC · ⌖ 8.56 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 20, 2026, 4:30 AM UTC

Start by checking the default branch for .github/workflows/cao.json and compare its target-authority declaration with the live packages used by AW Doctor and Dependabot Release Trains. Use the representative workflow runs to inspect Run CAO control precompute and determine whether the file is missing, incorrect, or unreadable. Done means the declaration is valid and one affected AW Doctor workflow plus one affected Dependabot workflow passes without Target authority missing.

Written by the indexing model from the issue text.