Device part of 95ec322: scoped risk targets are derived from the source
rows of each occurrence, so a device-finding cannot target a device that
the selected occurrence does not list.
Adapted pick of d9ff6a8: device-finding and device-snapshot targets with
immutable snapshots, migration 028, repositories, API, Defender panel,
Finding Reader and the Accepted Risks register.
Unlike the original, the register keeps the base rule for its current
count, and a scoped decision covers only the occurrences it captured.
After a reimport it stays with its full history, shows Review required
and covers nothing, like a whole-finding acceptance.
Binh