fix: case registry locking, watchdog override verification, transcript path resolution

[cursor]

Summary

Daily critical-correctness scan found four high-severity bugs in recent behavioral changes that had escaped review. All fixes cherry-picked from validated commit 6e8268a.

Bugs fixed

1. Duplicate Case Nos (litigation/run.py)

• Impact: Data corruption — multiple transcripts assigned identical Case Nos when registry missing or under concurrent saves.
• Root cause: allocate_case_no() returned a fixed DEL-001 without persisting when case-registry.yaml was absent; read-modify-write had no file locking.
• Fix: Create registry on first use, exclusive fcntl lock, fsync, and year rollover reset.

2. Watchdog override bypass (executive/watchdog.py)

• Impact: Security — executive actions with action_type containing "override" skipped judicial approval checks entirely, even with invalid/missing proof.
• Root cause: Approval gate was skipped when action type contained "override" rather than requiring OverrideProof.verify().
• Fix: Override actions must present a cryptographically valid proof; unapproved non-override actions still alert.

3. Export path double-prefix (courtroom/portal/export_transcript.py)

• Impact: User-facing breakage — courtroom/transcripts/foo.md resolved to nonexistent courtroom/courtroom/transcripts/foo.md.
• Root cause: BASE_DIR / args.transcript without stripping repo-root courtroom/ prefix.
• Fix: resolve_transcript_path() normalizes paths relative to courtroom root.

4. Litigation viewer wrong transcript (litigation/viewer.py)

• Impact: Wrong transcript served when short query matched as substring inside unrelated filename (e.g. bar → foo-bar).
• Root cause: name in p.stem arbitrary substring matching.
• Fix: Exact/prefix/suffix resolution with preference for exact matches.

Validation

• 69 tests passing (9 new regression tests)
• Manual verification of registry persistence, export path resolution, and viewer disambiguation