Casework: a task template preview is silently skipped when a subject field is denied, concealed, or missing

## What

When Casework builds the task template previews for a work item, it reads each template's subject fields live, under the officer's own token, through the source adapter. If the source answers `Denied` or `Concealed`, or if `disclosed_subjects` cannot produce a value, the loop skips that template with a bare `continue`. The officer sees a shorter list of offerable tasks with no indication that a template was withheld or why. A misconfigured template, a subject field the officer's read profile cannot see, or a record missing a subject value all present identically: the task is simply never offered.

Nothing catches this before runtime either. `caseworkctl check` has no diagnostic that cross-checks a template's subject fields against the read authority of the profiles that will preview it.

## Evidence

- `crates/registry-casework/src/task_grants.rs`, the preview loop around lines 466 to 500:
- `Err(registry_casework_core::SourceAdapterError::Denied | registry_casework_core::SourceAdapterError::Concealed) => continue,` after `read_task_context`
- `let Ok(subjects) = template.disclosed_subjects(&context.values) else { continue; };`
- Both arms discard the template without recording anything. The surrounding function returns only `TaskTemplatePreviews { item_revision, templates }`, so there is no channel for a withheld entry.
- `rg task_template crates/registry-caseworkctl/src` shows template handling in `dev/integrations.rs` and `dev/mod.rs` only; no check-time subject readability diagnostic exists.

## Proposed fix

Two parts.

1. Return a structured warning alongside the previews naming the template id, the work item and the field or condition that caused the omission, and surface it in the officer response so a UI can say "one template was not offered" rather than silently showing fewer. Keep the field value out of the warning; the template and field id are enough.
2. Add a `caseworkctl check --source-project` cross-check that every subject field named by every task template is readable by every access profile eligible to preview it, so the misconfiguration is refused at check time instead of disappearing at runtime.

## Found while

Extracting reusable App Kit skills against Registry Stack v0.32.0.

Start with the preview loop in crates/registry-casework/src/task_grants.rs around lines 466-500, then inspect the TaskTemplatePreviews response and the task-grant flow around it. Run rg task_template crates/registry-caseworkctl/src and read dev/integrations.rs and dev/mod.rs to locate existing check-time template handling. Done means withheld templates produce structured warnings without field values, appear in the officer response, and check can cross-check subject readability for eligible profiles.

Written by the indexing model from the issue text.