Function open 

pub fn open(
    root: &Path,
    finding_ref: FindingRef,
    title: impl Into<String>,
    severity: Severity,
    impact: u8,
    likelihood: u8,
    affected_systems: Vec<String>,
    sla_days: u32,
    due_at: NaiveDate,
    actor: &str,
    agent: Option<Agent>,
    ts: Option<DateTime<Utc>>,
) -> Result<OpenOutcome>

Allocate the next R-NNNN id under the root lock and write the opened event. The fingerprint is <control_id>:<finding_id> carried in finding_ref.

Callers that promote a sealed draft_risk from a run should first call verify_finding_ref so the risk cannot be bound to absent or fabricated evidence.