fix: case registry locking, watchdog proof verification, viewer matching, export paths

[cursor]

Summary

Daily critical-correctness scan found four high-severity bugs in recent litigation/executive/portal code that escaped review. All fixes are minimal and covered by regression tests (69 passing).

Bugs fixed

1. Duplicate Case Nos (litigation/run.py)

• Impact: Data corruption — multiple transcripts assigned the same Case No.
• Root cause: allocate_case_no() returned a fixed DEL-001 when case-registry.yaml was missing (never persisted), and used unlocked read-modify-write under concurrency.
• Fix: Create registry on first use, exclusive fcntl lock, fsync, and year-rollover counter reset.

2. Watchdog override bypass (executive/watchdog.py)

• Impact: Security — monitoring defeated by bogus override_proof or action_type containing "override".
• Root cause: Watchdog only checked proof presence, not cryptographic validity; non-override actions with any non-empty proof skipped approval checks.
• Fix: Require OverrideProof.verify() for override actions; non-override actions always require judicial approval.

3. Wrong transcript served (litigation/viewer.py)

• Impact: User-facing breakage — show/serve could return the wrong transcript (e.g. query bar matched foo-bar).
• Root cause: Arbitrary substring matching (name in stem).
• Fix: Exact/prefix/suffix resolution with preference for exact matches.

4. Export path double-prefix (courtroom/portal/export_transcript.py)

• Impact: Portal export 404 when passed repo-root paths like courtroom/transcripts/foo.md.
• Root cause: Paths were joined relative to courtroom/ without stripping the courtroom/ prefix.
• Fix: resolve_transcript_path() normalizes repo-root, courtroom-relative, and absolute paths.

Validation

python3 -m pytest tests/ -q
# 69 passed