[cao-maintenance:integrity] Control-plane integrity requires attention

Four catalog packages declare worker workflows in `cao.json`, their `README.md`, and compiled `.lock.yml` sources, but omit those same workflows from their package `aw.yml` `includes:` list. Installing or updating these packages with `gh aw add`/`gh aw update` will not deploy the missing workers to control repositories, silently breaking the policy → package → installed-workflow mapping.

**Action:** A maintainer (or Copilot, if assigned) should add the missing `.md` paths to each affected `aw.yml`'s `includes:` list and re-run `npm run compile:locks` to confirm no regressions. Acceptance check: for every package in `.github/workflows/cao.json`, every `workers.*.workflow` value has a corresponding `.github/workflows/.md` entry in that package's `aw.yml` `includes:`.

Evidence: packages with workers missing from aw.yml includes

Checked at commit `a27dbf8b3c90714ee9d9e715f7e9e2c5a60e207e`. For each package in `.github/workflows/cao.json`, cross-referenced `control-plane.packages..workers.*.workflow` against the `includes:` list in `/aw.yml`. All corresponding `.md` and `.lock.yml` source files exist and compile; only the manifest registration is missing.

| Package | `aw.yml` | Missing worker (registered in `cao.json`, present as `.md`+`.lock.yml`, missing from `includes:`) |
|---|---|---|
| `uk-ai-advisory` | `uk-ai-advisory/aw.yml` | `uk-ai-advisory-operational-resilience` (also documented in `uk-ai-advisory/README.md` package-contents table) |
| `aw-doctor` | `aw-doctor/aw.yml` | `aw-maintenance-upgrade` |
| `dependabot` | `dependabot/aw.yml` | `dependabot-release-train-updater` (also documented in `dependabot/README.md` package-contents table) |
| `self-care` | `self-care/aw.yml` | `self-care-accessibility-checker`, `self-care-code-improvement`, `self-care-dashboard-review`, `self-care-open-source-failures`, `self-care-primer-brand-checker` (all five documented in `self-care/README.md` as part of the twelve dispatched workers) |

Packages that were checked and found consistent (all `cao.json` workers present in `includes:`): `cao-maintenance`, `eu-cra-compliance`, `optimization`, `software-development-practices`.

Agent prompt

In this repository, for each of the following `aw.yml` files, add the listed missing `.github/workflows/.md` entries to the `includes:` list (matching the existing list style and ordering used by sibling entries in the same file):

- `uk-ai-advisory/aw.yml`: add `.github/workflows/uk-ai-advisory-operational-resilience.md`
- `aw-doctor/aw.yml`: add `.github/workflows/aw-maintenance-upgrade.md`
- `dependabot/aw.yml`: add `.github/workflows/dependabot-release-train-updater.md`
- `self-care/aw.yml`: add `.github/workflows/self-care-accessibility-checker.md`, `.github/workflows/self-care-code-improvement.md`, `.github/workflows/self-care-dashboard-review.md`, `.github/workflows/self-care-open-source-failures.md`, `.github/workflows/self-care-primer-brand-checker.md`

Do not change `.github/workflows/cao.json`, any `.lock.yml` file, or any workflow `.md` source. After editing, run `npm run compile:locks` and confirm it succeeds with no unexpected diffs to unrelated lock files, then run `npm run check`.

### Control Plane
- Correlation ID: `34542376589-2`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/34542376589

> Generated by [CAO Maintenance / Integrity](https://github.com/githubnext/gh-aw-cao/actions/runs/34542376589) · copilot · auto · 60.3 AIC · ⌖ 10.4 AIC · ⊞ 11.8K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-maintenance-integrity%22&type=issues)
> - [x] expires on Sep 24, 2026, 11:37 PM UTC

Start with the listed uk-ai-advisory/aw.yml, aw-doctor/aw.yml, dependabot/aw.yml, and self-care/aw.yml files, comparing their includes lists with .github/workflows/cao.json. Add the explicitly listed workflow paths without changing cao.json, lock files, or workflow sources. Run npm run compile:locks, check for unexpected lockfile changes, then run npm run check; done means every cao.json worker has a matching aw.yml include.

Written by the indexing model from the issue text.