[aw-maintenance:failures-investigator] Daily Runtime Threat Scan blocked by outdated compile-agentic version (v0.83.1)

**Affected repository**: `github/gh-aw-actions`
**Affected workflow**: `.github/workflows/daily-runtime-threat-scan.lock.yml` ("Daily Runtime Threat Scan")
**Error signature**: activation job fails at step "Check compile-agentic version" with `##[error]Blocked compile-agentic version: v0.83.1 is in the blocked versions list. Update gh-aw to the latest version and recompile your workflow.`

### Problem

Every recent run of the Daily Runtime Threat Scan workflow fails during activation because it was compiled with `gh-aw` version `v0.83.1`, which is now on the blocked-versions list fetched from `https://raw.githubusercontent.com/github/gh-aw-actions/main/.github/aw/compat.json`. The workflow never reaches the `agent` job while this block is in effect — it is deterministic, not transient.

### Evidence (affected runs)

- https://github.com/github/gh-aw-actions/actions/runs/33807348028 (2026-09-03T21:19:52Z)
- https://github.com/github/gh-aw-actions/actions/runs/33802522237 (2026-09-03T20:29:07Z)

Both runs show identical `GH_AW_COMPILED_VERSION: v0.83.1` in the job env and the same blocked-version error at the "Check compile-agentic version" step.

### Probable root cause

The compiled lock file (`daily-runtime-threat-scan.lock.yml`) embeds a pinned `gh-aw`/compile-agentic version (`v0.83.1`) that has since been added to the repository's blocked-versions compatibility list. Until the workflow source is recompiled with a non-blocked `gh-aw` version, every scheduled/triggered run will fail at activation before any agent work occurs.

### Proposed remediation

1. Update the `gh-aw` CLI/tooling used to compile workflows in `github/gh-aw-actions` to a version not present in `.github/aw/compat.json`'s blocked list.
2. Recompile `.github/workflows/daily-runtime-threat-scan.md` (or equivalent source) with `gh aw compile` to regenerate `daily-runtime-threat-scan.lock.yml` with the updated `GH_AW_COMPILED_VERSION`.
3. Commit the regenerated lock file alongside the source change.

### Success criteria

- A subsequent run of "Daily Runtime Threat Scan" completes the `activation` job's "Check compile-agentic version" step without the blocked-version error.
- The run's `agent` job executes (or the workflow proceeds past activation) instead of failing at version check.

See the failure report issue for full context on this run's failure clustering.

### Control Plane
- Correlation ID: `33818698355-78`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33818698355

> Generated by [:rotating_light: AW Maintenance / Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33818698355) · copilot · auto · 43.8 AIC · ⌖ 8.93 AIC · ⊞ 14.9K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-failures-investigator%22&type=issues)
> - [x] expires on Sep 17, 2026, 11:47 PM UTC

Inspect .github/workflows/daily-runtime-threat-scan.lock.yml and the corresponding daily-runtime-threat-scan.md source, then check .github/aw/compat.json for the blocked version. Recompile the workflow with gh aw compile using a non-blocked version and commit the regenerated lock file. Done means the activation version check passes and the agent job proceeds.

Written by the indexing model from the issue text.