fix(casework): align runtime schema secret-reference validation

The generated Casework runtime schema applies exact secret-reference validation to static JWKS `documentRef`, but database, audit, and BReg source-binding references still use only a provider-prefix pattern. For example, the schema accepts `database.runtimeUrlRef: secret:env/lowercase`, or `secret:env/DB` when only the file provider is enabled. `RuntimeConfig::validate_secret_references` correctly rejects both.

Triage: nonblocking editor-validation consistency defect. Runtime reference grammar and provider enforcement remain effective; this does not allow an invalid configuration to run. Defer from #996 so its reviewed, passing implementation can merge.

Follow-up work:

- Apply `SECRET_REFERENCE_SCHEMA_PATTERN` to every secret-reference field in `crates/registry-casework/src/schema.rs`.
- Require the corresponding non-null enabled provider for database, audit, static JWKS, and arbitrary BReg source bindings.
- Preserve valid absent/null optional references, and handle mixed file/environment references across multiple sources.
- Add schema/runtime parity tests for invalid reference grammar, missing or null providers, optional references, and valid mixed sources.
- Regenerate the committed runtime schema and any dependent identifier catalog output with their owning generators; run focused schema and generated-contract checks.

Original review: https://github.com/registrystack/registry-stack/pull/996#discussion_r3995094763

Start in crates/registry-casework/src/schema.rs and compare its secret-reference rules with RuntimeConfig::validate_secret_references. Add parity coverage for invalid grammar, provider availability, optional references, and mixed sources, then use the owning generators to regenerate the committed runtime schema and identifier catalog. Run the focused schema and generated-contract checks; done means schema and runtime validation agree.

Written by the indexing model from the issue text.