Function associate_access_targets 

pub fn associate_access_targets(
    findings: &[VerifiedFinding],
) -> AccessTargetReport

Attach access targets to a finding set, reading file context from disk.

This is the entry point the CLI uses behind --access-targets. It is never called on the default path, so a default scan pays nothing for it.

The read goes through RetryingContentSource, the product’s one retry policy, so a file removed or locked between the scan and this pass gets a bounded second look before it becomes a coverage gap. Only ContentError::TransientRead is retried; a permission denial returns on the first attempt.