refactor: reduce complexity of add_report_findings in custom_jobs.rs

[github-actions]

Summary

add_report_findings in src/audit/analyzers/custom_jobs.rs exceeded Clippy's too_many_lines threshold (131/100), driven by a single loop body containing six independent, inline if/Finding-push blocks.

Change

Extracted each independent check into its own well-named helper function returning Option<Finding>, appended to the findings vec via Vec::extend:

• incomplete_provenance_finding
• job_identity_mismatch_finding
• ran_without_proposals_finding
• ran_after_unsafe_detection_finding
• ran_without_approval_finding
• expected_job_missing_finding

The loop body in add_report_findings is now a short, readable sequence of calls. No public API changed, and behaviour is identical (same findings, same order, for the same inputs).

Before / after

• Before: clippy::too_many_lines warning (131/100) on add_report_findings.
• After: no too_many_lines warning for this function.

Verification

• cargo build — passes
• cargo test (full suite) — all tests pass, including all 9 existing unit tests in audit::analyzers::custom_jobs
• cargo clippy --all-targets --all-features — clean, no warnings

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · auto · 77.1 AIC · ⌖ 6.68 AIC · ⊞ 10.2K · ◷

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[jamesadevine]

Closed as partially superseded by aggregate PR #2189, which retains the add_report_findings helper extraction. Unrelated or overlapping cumulative changes were intentionally omitted.