List a cascade's registered test-case subjects

What changed

New endpoint GET /workflows/{id}/test_cases (workflows:read). It walks the cascade's product nodes, maps each product to its family in the CRS test-case registry, and returns every registered subject with a payload shaped for POST /workflows/{id}/trigger — the same subjects the visual builder's sandbox tests panel runs. In test mode the subjects return schema mocks like any applicant (set payload.scenario to fail_path for decline branches); registry replay applies to live-mode sandbox runs.

{
  "data": {
    "object": "test_case_list",
    "workflow_id": 27,
    "test_cases": [
      { "id": 54, "case_name": "Cascades_Credit_660_Inq0", "product_code": "TUC1001", "payload": { "applicant": { "…": "…" }, "property": { "…": "…" } } }
    ]
  }
}

The endpoint is best-effort: an unreachable registry returns an empty list, never a 5xx. The MCP server exposes it as cascades_list_test_cases.

Also in this release:

• A test-mode trigger on a draft cascade now runs instead of being refused; live triggers on drafts still return 409 workflow_inactive (2026-09-03).
• Cascade activation over the API is gated on production access: sandbox accounts create drafts and get a note; PATCH with active: true returns 403 activation_forbidden (2026-09-03).

See Test identities and Sandbox vs live.