[aw-maintenance:failures-investigator] Fix: Daily Runtime Threat Scan blocked by pinned compile-agentic version v0.83.1

**Problem**: The `Daily Runtime Threat Scan` workflow (`.github/workflows/daily-runtime-threat-scan.lock.yml`) in `github/gh-aw-actions` fails during the `activation` job's `Check compile-agentic version` step on every recent scheduled run.

**Affected runs**:
- `https://github.com/github/gh-aw-actions/actions/runs/33807348028` (2026-09-03T21:19:52Z)
- `https://github.com/github/gh-aw-actions/actions/runs/33802522237` (2026-09-03T20:29:07Z)

**Error signature** (identical on both runs):
```
##[error]Blocked compile-agentic version: v0.83.1 is in the blocked versions list. Update gh-aw to the latest version and recompile your workflow.
```

**Probable root cause**: The workflow's lock file was compiled with `gh-aw` `v0.83.1`, which has since been added to a blocked-versions list (likely due to a known defect or security issue in that release). The activation guard now hard-fails every run before the agent job executes, blocking all scheduled and manual invocations of this workflow.

**Proposed remediation**:
1. Update the `gh-aw` CLI/action dependency used to compile `daily-runtime-threat-scan.md` to a non-blocked, current release.
2. Recompile the workflow source (`gh aw compile daily-runtime-threat-scan.md`, or the repository's equivalent compile command) to regenerate `.github/workflows/daily-runtime-threat-scan.lock.yml` with the updated toolchain version.
3. Commit the regenerated lock file alongside the source change so future compiles stay in sync.

**Success criteria**:
- The next scheduled or manual run of `Daily Runtime Threat Scan` passes the `activation` job's `Check compile-agentic version` step without a blocked-version error.
- The regenerated `.lock.yml` reflects a `gh-aw` version not present in the blocked-versions list.

See the companion failure report issue for full bucket correlation and evidence.

### Control Plane
- Correlation ID: 33814181349-75
- Central repository: githubnext/gh-aw-cao
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/33814181349

> Generated by [:rotating_light: AW Maintenance / Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33814181349) · copilot · auto · 24.6 AIC · ⌖ 12.7 AIC · ⊞ 14.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-failures-investigator%22&type=issues)
> - [x] expires on Sep 17, 2026, 10:47 PM UTC

Start with daily-runtime-threat-scan.md and its generated .github/workflows/daily-runtime-threat-scan.lock.yml. Check the gh-aw version used by the repository, run `gh aw compile daily-runtime-threat-scan.md` or the repository equivalent, and inspect the regenerated lock file. Done means the lock file uses a non-blocked version and the activation job's Check compile-agentic version step passes.

Written by the indexing model from the issue text.