doc-pair + legajo create-vs-update TOCTOU: advisory locks serialize create-vs-create only; no DB unique on doc-pair/legajo → race can mint two live rows sharing a documento or legajo

Surfaced by audit-mars-ca post-push cold review of MARS-532 (3b547a3). NOT a 532 regression — same TOCTOU class findDocumentConflict already had pre-532. Identity-attach dedup vectors email + googleSub ARE DB-unique-enforced (those hold). doc-pair (documentoType+documentoNumber) and legajo have NO DB unique, so a create-vs-update race under advisory locks (which only serialize create-vs-create) can mint two live rows sharing a doc/legajo. Full close: DB partial-unique indexes on doc-pair + legajo WHERE deletedAt IS NULL — requires data dedup FIRST (may surface real live duplicates needing careful merge — Class-A, audit pre-apply, coordinate coder). db-lane leads, coder aligns app-side conflict handling.