[self-care:open-source-failures] Restore live-mode target authority for blocked automation workflows

Live-mode target authority is missing in `githubnext/gh-aw-cao`, and the bounded snapshot shows 20 failed runs across 4 workflows blocked before activation. The evidence consistently reports `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`, so the most likely fix is to restore or correct target authority on the protected default branch.

**Action:** CAO maintainers should verify the live-mode target-authority declaration on the default branch and repair it if needed; accept when a fresh run of each affected workflow passes pre-activation without the target-authority error.

Agent prompt
Inspect the live-mode authority path for `githubnext/gh-aw-cao`. Confirm that `.github/workflows/cao.json` exists on the protected default branch, that it grants the intended control repository authority for the affected live packages, and that recent workflow SHA or policy changes did not break resolution. Propose the smallest safe fix, update tests or validation if coverage is missing, and summarize how you verified pre-activation no longer fails with the target-authority error.

- Severity: P0
- Repository: `githubnext/gh-aw-cao`
- Affected workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Run count in bounded snapshot: 20
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/34062115824
- Confidence: high
- Evidence-supported cause: live-mode target authority could not be resolved for the target default branch
- Bounded fix: restore or correct `.github/workflows/cao.json` authority data on the default branch for the affected live packages

Representative runs

- https://github.com/githubnext/gh-aw-cao/actions/runs/34062115824
- https://github.com/githubnext/gh-aw-cao/actions/runs/34062110957
- https://github.com/githubnext/gh-aw-cao/actions/runs/34062105731
- https://github.com/githubnext/gh-aw-cao/actions/runs/34062096653
- https://github.com/githubnext/gh-aw-cao/actions/runs/34062092059
- https://github.com/githubnext/gh-aw-cao/actions/runs/34062087625
- https://github.com/githubnext/gh-aw-cao/actions/runs/34060809161
- https://github.com/githubnext/gh-aw-cao/actions/runs/34060797196
- https://github.com/githubnext/gh-aw-cao/actions/runs/34060791862
- https://github.com/githubnext/gh-aw-cao/actions/runs/34060787110

### Control Plane
- Correlation ID: `34064016587-313`
- Central repository: `githubnext/gh-aw-cao`
- Control-plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34064016587

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/34064217561) · pi · gpt54 · 33.4 AIC · ⌖ 8.55 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 20, 2026, 10:37 PM UTC

Inspect .github/workflows/cao.json on the protected default branch, then compare its authority data with the four affected workflow files and the representative failed runs. Verify the intended control repository authority and any recent workflow SHA or policy changes; done means a fresh run of each affected workflow passes pre-activation without the target-authority error.

Written by the indexing model from the issue text.