fix: case registry locking, watchdog proof verification, viewer matching, export paths

[cursor]

Summary

Nightly critical-correctness scan found four high-severity bugs still present on main after recent portal path fixes (#54, #66, #84).

Bugs fixed

1. Duplicate Case Nos (litigation/run.py)

• Impact: Data integrity — concurrent transcript saves or a missing case-registry.yaml could assign the same Case No. to multiple transcripts.
• Root cause: allocate_case_no() returned a fixed DEL-001 when the registry file was absent (never persisted), and read-modify-write had no file locking under concurrency.
• Fix: Create registry on first use, exclusive fcntl lock + fsync, year rollover reset, treat category counter 0 as first case.

2. Executive override bypass (executive/watchdog.py)

• Impact: Security — override actions skipped judicial approval checks when action_type contained "override" or any non-empty override_proof was present without HMAC verification.
• Root cause: Conditional logic exempted override actions from approval checks instead of requiring cryptographic proof.
• Fix: Require OverrideProof.verify() for all override actions; alert on missing or invalid proofs.

3. Wrong transcript served (litigation/viewer.py)

• Impact: User-facing breakage — HTTP/CLI viewer used arbitrary substring matching (name in p.stem), so query bar could return foo-bar.
• Fix: Resolve by exact name, prefix, or -suffix/_suffix only; prefer shortest exact match.

4. Export path double-prefix (courtroom/portal/export_transcript.py)

• Impact: Portal export 404 — paths like courtroom/transcripts/foo.md resolved to courtroom/courtroom/transcripts/foo.md.
• Fix: resolve_transcript_path() strips redundant courtroom/ prefix before joining to BASE_DIR.

Validation

• python3 -m pytest tests/ -q — 69 passed
• Added regression tests for registry creation, year rollover, concurrent allocation, watchdog override proof enforcement, export path resolution, and viewer suffix matching.