Name the refused secret reference when a BReg source binding fails to build

### What we hit

Follow-up to #977. Database, audit-journal, and static-JWKS secret failures now name the operator-authored reference and the rule it broke, without echoing secret bytes. The BReg source binding does not.

In `crates/registry-casework-breg/src/config.rs`, `resolve_secret` maps every `SecretError` for `clientIdRef`, `clientAssertionKeyRef`, `webhookSecretRef`, and the optional trust references to `SourceAdapterError::Invalid`. `build_runtime` in `crates/registry-casework/src/runtime.rs` then maps that to `RuntimeError::SourceConfiguration(source_id)`, so the operator sees only:

```
the Casework source binding for source professional-register is invalid
```

A binding declares up to five secret references plus two URLs and a description file, and the message does not say which one was refused or why (missing file, wrong mode, ownership, hard links, NUL byte, or reference grammar).

### Where it maps

- `crates/registry-casework-core/src/adapter.rs`: `SourceAdapterError` has no variant that carries a configuration diagnostic, and the core must stay source-neutral.
- `crates/registry-casework-breg/src/config.rs`: `resolve_secret`, `parse_url`, `read_description` all collapse to `Invalid`.
- `crates/registry-casework/src/runtime.rs`: `build_adapter(...).map_err(|_| RuntimeError::SourceConfiguration(...))`.
- `crates/registry-casework/src/config.rs`: `describe_secret_failure` already produces the bounded sentence the other paths use.

### Ask

Carry a bounded, secret-free diagnostic from adapter construction to the startup error: either a `SourceAdapterError` variant holding the described failure (reference text plus rule, never the resolved bytes or the opened path), or a separate construction error type that `build_adapter` returns and the runtime formats with `describe_secret_failure`. The message must name the source, the setting (`clientIdRef` and so on), and the rule. Add the same test shape as `tests/secret_diagnostics.rs` for a binding with a mode 0644 key file.

`caseworkctl doctor` already preflights `secret:file/` references per setting, so this is only the runtime startup path.

Start with SourceAdapterError in crates/registry-casework-core/src/adapter.rs, then trace resolve_secret, parse_url, and read_description in crates/registry-casework-breg/src/config.rs through build_adapter and build_runtime. Read describe_secret_failure in crates/registry-casework/src/config.rs and use tests/secret_diagnostics.rs as the model. Done means startup output names the source, setting, and rule without exposing secret bytes or opened paths, including the mode 0644 key-file case.

Written by the indexing model from the issue text.