fix: case registry locking, watchdog override verification, export paths

[cursor]

Summary

Nightly bug scan found three critical correctness issues still present on main after recent portal/test commits (#54, #66, #84). This PR applies minimal, targeted fixes with regression tests.

Bugs fixed

1. Executive watchdog override bypass (security)

• Impact: Override actions could bypass judicial approval checks entirely.
• Trigger: Record an action with action_type containing "override", or any non-empty override_proof string for an unapproved ruling — watchdog silently passed.
• Root cause: Logic skipped validation when "override" appeared in action_type, and treated any non-empty proof as sufficient without HMAC verification.
• Fix: Require OverrideProof.verify() for override actions; alert on missing/invalid proofs.

2. Duplicate Case Nos from allocate_case_no() (data integrity)

• Impact: Concurrent or repeated transcript saves could assign duplicate Case Nos; missing registry always returned DEL-001.
• Trigger: Two litigation saves in parallel, or first run on a machine without case-registry.yaml.
• Root cause: Unlocked read-modify-write on registry YAML; missing-registry path returned a fixed ID without persisting.
• Fix: Create registry when missing, exclusive fcntl lock, fsync, year rollover reset, and max(nnn, 1) for zero-seeded categories.

3. Portal export path double-prefix (user-facing breakage)

• Impact: export_transcript.py failed when passed repo-root paths like courtroom/transcripts/foo.md (documented usage).
• Root cause: Relative paths were always prefixed with courtroom/, producing courtroom/courtroom/transcripts/....
• Fix: resolve_transcript_path() strips a leading courtroom/ before resolving against BASE_DIR.

4. Litigation viewer ambiguous transcript match

• Impact: viewer.py show bar could return foo-bar transcript due to substring matching.
• Fix: Match by exact stem, prefix, or -bar/_bar suffix only.

Validation

• python3 -m pytest tests/ -q — 69 passed
• Added tests for watchdog override proof enforcement, registry locking/concurrency, export path resolution, and viewer disambiguation.