feat: write report bodies into the case directory

case.py stays the only writer of the manifest, so generate returns it and
the caller saves. A modified body is backed up with a timestamp before
--force overwrites it.

Bodies are written and read as BYTES, not text. The plan used read_text
and write_text, which fail two ways at once. The locale encoding is not
the utf-8 body_hash pins, so a body hashed differently under a non-UTF-8
LANG; and text mode applies universal newlines, so a report delimited by
CRLF came back with every CRLF collapsed to LF. The second was live on
every platform: regenerating an untouched case raised Modified, because
the body read back never hashed to what was written. For a sent
destination that hash is the record of what was disclosed, so it has to
be the hash of the bytes on disk. Text mode would also translate the bare
LFs inside the machine-readable part on a CRLF platform, corrupting the
field block a desk's parser reads.

The refusal ordering is now pinned by tests rather than left implicit: a
frozen or modified case must leave the bodies directory byte-for-byte as
it was, asserted over the whole directory rather than one file. bodies
is created without parents, so a missing case directory raises rather
than scattering bodies into a tree generate invented.

The backup test pins the filename, not just the count of .orig files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LByBnw83xr9YP85nskzkyE

0 files changed, 0 insertions, 0 deletions