fix: critical correctness — case registry, watchdog overrides, transcript paths

[cursor]

Summary

Daily critical-correctness scan identified four high-severity bugs still present on main after recent portal/test commits (#54, #66, #84).

Bugs fixed

1. Duplicate Case Nos / registry corruption (litigation/run.py)

• Impact: Concurrent transcript saves could assign identical Case Nos; missing registry returned hardcoded DEL-001 without persisting.
• Root cause: Unlocked read-modify-write on case-registry.yaml; early return when registry missing.
• Fix: fcntl exclusive lock, create registry on first use, year rollover reset, max(nnn, 1) for zero-seeded categories.

2. Executive override bypass (executive/watchdog.py)

• Impact: Any action with override in action_type skipped approval checks; any non-empty override_proof bypassed verification.
• Root cause: Inverted guard logic treated override label as exemption instead of requiring OverrideProof.verify().
• Fix: Override actions must present HMAC-verified proof; unapproved non-override actions still alert.

3. Portal export 404 (courtroom/portal/export_transcript.py)

• Impact: Paths like courtroom/transcripts/foo.md resolved to nonexistent courtroom/courtroom/transcripts/foo.md.
• Root cause: BASE_DIR / args.transcript double-prefixed when path already included courtroom/.
• Fix: resolve_transcript_path() strips repo-root prefix before joining.

4. Wrong transcript served (litigation/viewer.py)

• Impact: Query bar matched foo-bar via substring (name in stem).
• Root cause: Overly broad substring matching in cmd_show and HTTP handler.
• Fix: Exact, prefix, or suffix (-{name} / _{name}) matching via _resolve_transcript().

Validation

• 69 tests passing (python3 -m pytest tests/)
• New regression tests for all four fixes