fix: keep the FAILED status of a launch that never started

[florian-simvia]

What

registry_transaction now saves in a finally, so a write made before the body
raises is no longer discarded. Five lines of production code.

Why

_launch_local and _launch_slurm record status=FAILED and then raise to
report the failure. registry_transaction only saved when the body completed
normally, so that write was thrown away and the case stayed PENDING forever,
with nothing to tell the user it never ran. Those update_case(..., FAILED)
calls were effectively dead code.

Reproduced before the fix:

with registry_transaction(runs_dir) as registry:
    update_case(registry, "case0001", status="PENDING")
try:
    with registry_transaction(runs_dir) as registry:
        update_case(registry, "case0001", status="FAILED")   # what _launch_local writes
        raise RuntimeError("docker not found")               # then it raises
except RuntimeError:
    pass
load_registry(runs_dir)["case0001"]["status"]   # -> "PENDING"

Triggers in practice: no docker or sbatch on PATH, a solver binary that is
not executable, a rejected sbatch submission.

Call site audit

registry_transaction has ten call sites, so the semantics change was audited
one by one before touching it:

Site	Writes before a possible raise?	Effect
runner._start_case	yes, status=FAILED then raises	the fix
runner x3 (pending mark, running snapshot, finalize)	no raise in the body	unchanged
web_support.kill_case (lookup)	raises before writing; later writes are discovered container_id / job_id	correct to keep
web_support.kill_case (final), api_case_note	one write, nothing raises	unchanged
api_case_convergence	raises before the write	unchanged
api_cleanup_cases	loop of writes, OSError possible	correct, those cases really were reset
doe.generate_cases	writes entries while creating case dirs	improvement, see below

generate_cases gains from the change. When prepare aborts part way, the case
directories it already created are not rolled back, so discarding their registry
entries bought no atomicity: it only left the filesystem and the registry out of
step. They now stay in agreement.

How to test

pytest -q   # 383 passed, 3 skipped

Three new tests, two written first and observed failing: registry_transaction
persists a write made before an exception, it still saves normally without one,
and run_cases leaves the case FAILED rather than PENDING when Popen
raises.

Note on real-world verification: forcing the PENDING path end to end means
removing docker from PATH or having Slurm reject a submission, since docker
starts before failing on a bad image. That path is covered by the unit test
where Popen raises, not by a physical reproduction.

Checklist

• Tests pass locally (pytest -q)
• No linting errors (ruff check . && ruff format --check .)
• Frontend builds — not applicable, no frontend file touched
• frontend/dist/ is up-to-date — not applicable, unchanged