[self-care:open-source-failures] Fix repeated live-mode target-authority rejections in githubnext/gh-aw-cao workflows

At least 20 live-mode runs in the bounded snapshot failed before activation because self-targeting workflows in `githubnext/gh-aw-cao` were rejected with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`. This blocks multiple maintenance and Dependabot workflows before they can do useful work.

**Action:** CAO maintainers should fix the target-authority configuration path for these self-targeting live workflows; accept when fresh runs of `Dependabot / Release Trains`, `AW Doctor / Upgrade`, `AW Doctor / Compiler Security`, and `AW Doctor / Failures` all pass `Run CAO control precompute` without the target-authority error.

Agent prompt
Investigate why live self-targeting workflows in `githubnext/gh-aw-cao` are failing CAO control precompute with `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`. Verify the control repository and target-authority expectations for a source-managed control repository, inspect the affected workflow sources and policy, identify why precompute is not recognizing the repository's own `.github/workflows/cao.json` on the protected default branch, implement the smallest safe fix, regenerate any required lock files, and validate with the narrowest relevant tests plus compile.

Critical findings:
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/34029996819
- Same signature recurred in at least 20 enriched runs across four workflows in the bounded snapshot.
- Affected workflows observed: `dependabot-release-train-updater.lock.yml`, `aw-maintenance-upgrade.lock.yml`, `aw-maintenance-compiler-security.lock.yml`, `aw-failures-investigator.lock.yml`.
- Evidence supports a configuration or authority-resolution problem in control precompute; bounded evidence does not show a downstream execution failure.

Bounded evidence

Representative runs by workflow:
- Dependabot / Release Trains: https://github.com/githubnext/gh-aw-cao/actions/runs/34029996819
- AW Doctor / Upgrade: https://github.com/githubnext/gh-aw-cao/actions/runs/34022903477
- AW Doctor / Compiler Security: https://github.com/githubnext/gh-aw-cao/actions/runs/34022898891
- AW Doctor / Failures: https://github.com/githubnext/gh-aw-cao/actions/runs/34022890349

Observed repeated failure message:
- `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`

Bounded counts:
- `dependabot-release-train-updater.lock.yml`: 5 enriched runs with this exact message
- `aw-maintenance-upgrade.lock.yml`: 5 enriched runs with this exact message
- `aw-maintenance-compiler-security.lock.yml`: 5 enriched runs with this exact message
- `aw-failures-investigator.lock.yml`: 5 enriched runs with this exact message

Evidence window: last `168` hours; snapshot truncated to newest 100 failed runs.

### Control Plane
- Correlation ID: `34033044136-283`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34033044136

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/34033255907) · pi · gpt54 · 21.4 AIC · ⌖ 8.69 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 20, 2026, 12:35 PM UTC

Start with the target-authority handling for live-mode control precompute and the repository's .github/workflows/cao.json on the protected default branch. Compare the affected dependabot-release-train-updater.lock.yml, aw-maintenance-upgrade.lock.yml, aw-maintenance-compiler-security.lock.yml, and aw-failures-investigator.lock.yml workflows with the control repository and policy expectations. Run the narrowest relevant tests and compile after the smallest safe fix; done means fresh runs pass Run CAO control precompute without the target-authority error.

Written by the indexing model from the issue text.