fix: case registry duplicate Case Nos and override proof bypass

[cursor]

Summary

Fixes two critical correctness bugs found in recent litigation/executive changes.

Bug 1: Duplicate / stale Case Nos (litigation/run.py)

Impact: Every transcript saved without an existing courtroom/case-registry.yaml received the same Case No (YYYY-DEL-001-001). Concurrent saves could also corrupt the registry or assign duplicate numbers via unlocked read-modify-write.

Root cause: allocate_case_no() returned a hardcoded number when the registry was missing and wrote updates without file locking.

Fix: Create the registry on first use, use fcntl exclusive locking with fsync, and reset per-category counters on calendar year rollover.

Bug 2: Executive override auth bypass (executive/watchdog.py)

Impact: Override actions bypassed judicial approval checks if action_type contained "override" or any non-empty override_proof was present — no HMAC verification was performed. An attacker could log rogue overrides with a fake proof string.

Root cause: Watchdog only checked for presence of proof, never called OverrideProof.verify().

Fix: Override actions now require a valid HMAC proof; unapproved non-override actions still alert as before.

Validation

• python3 -m pytest tests/ — 66 passed
• New tests cover missing registry creation, concurrency uniqueness, year rollover, override-without-proof, and invalid override proof