CatDV Server: Unauthenticated RMI Root RCE via Internal Regcode ClientID Minting

CatDV Server 10.7.8: an unauthenticated RMI connect(null) makes the server mint a ClientID using its own internal regcode; saveSettings (ClientID-gated, no admin check) writes catdv.aaftoolPath; the factory-default empty admin password and the AAF export ProcessUtils.exec sink close a zero-credential root RCE chain (uid=0).