Why This Matters

generate_report() calls send_ingest() twice: once to create the investigation and again to attach the URL. That makes the write path harder to follow and test.

Read First

• app/nodes/publish_findings/node.py
• app/utils/ingest_delivery.py

Scope

1. Introduce one helper with a clear name for the "create investigation, then attach URL if present" flow.
2. Move the current two-call sequence into that helper.
3. Do not change the API contract of send_ingest() in the same PR unless absolutely necessary.

Tests / Coverage

• add direct tests for the new helper
• add one test where the first ingest succeeds and the second update fails
• add one test where no investigation ID is returned

Acceptance Criteria

• generate_report() no longer contains the duplicated ingest sequence inline
• failure behavior stays the same
• the helper name clearly explains the two-step flow