caseworkctl source add should support non-empty flow-style accessProfiles

## Problem

`caseworkctl source add` now accepts the shipped empty flow form `accessProfiles: []` and preserves a trailing comment when converting it to the block form needed for the generated reader profile. It still refuses a valid non-empty flow-style sequence such as `accessProfiles: [{id: reader, ...}]` because safely editing arbitrary flow YAML while preserving authored text and comments is a broader patching problem.

This is presentation-dependent behavior for valid BReg YAML, but it does not block the shipped starters or the tutorial added by #1016.

## Acceptance criteria

- `caseworkctl source add` can add the generated reader profile when `accessProfiles` is a valid non-empty flow-style YAML sequence.
- Both one-line and multiline flow sequences accepted by the BReg parser are covered.
- Existing profiles, comments, and unrelated authored text are preserved, or the command clearly previews an intentional localized normalization before apply.
- The rendered candidate round-trips to exactly the expected parsed BReg project.
- Conflicting existing `casework-reader` profiles remain fail-closed.

## Relationship

Follow-up to #1016. The common empty flow form is already handled there.

Start with the `caseworkctl source add` entry point and the BReg parser behavior for valid flow-style YAML. Exercise both one-line and multiline non-empty `accessProfiles` sequences, checking preservation of profiles, comments, and unrelated text. Done means the rendered candidate round-trips to the expected parsed project while conflicting `casework-reader` profiles still fail closed.

Written by the indexing model from the issue text.