Well, I tackled this project over the weekend.
It should have been easy. It wasn't.
I went to a local junkyard and got a handful of the washers and bolts.
I came home and started to loosen the bolt with a breaker bar, and it started out alright. Then it got harder to turn, and with surprisingly little effort, it snapped right off.
And of course, the subframe mount in question is the one with no top access to the captive nut. It'* the rear-most one. Double-bummer.
So... I did what I had to do. It was either cut a hole in the inner fender, or the dead-pedal area of the floor. The floor won, since carpet hides ugly repairs better than undercoating.
To make the hole, I drilled a series of small holes very close to each other on three sides, and then punched through the remaining material with a flat blade screwdriver and hammer. Then I peeled it up like a sardine can (the sheet steel there is disturbingly thin).
From there I could see that my captive nut was held in place by a sheet metal cover of sorts, which was welded in place on two sides. Channeling my anger and frustration, I beat on it with screwdrivers, hammers, and punches until I'd cut it in half, so that I could then peel the two welded-on sides away from the nut assembly, and remove it. It'* a rather large, diamond-shaped metal plate attached to the bottom of the nut, for the record.
Reassembly went well. I was going to use a new nut and flat washers on the top side, but apparently Lowes, Home Despot, Napa, Autozone, and TSC don't think m12 x 1.75 class 10.9 nuts are an item they need to carry. I was pissed. But it motivated me to work harder to unstick the stock nut and bolt-fragment, which did work, after PB blaster, heat (repeat a few times), vise-grips, and more brute force. I am glad it worked that way, because the stock nut assembly was still large enough/bulky enough that it wouldn't turn in it'* place as I tightened it up. Score! It'* not exactly captive, it could be pushed out of the way accidentally, but if someone was careful, they could remove it and replace it again without re-opening my access hole.
Speaking of the access hole: I folded the metal back into place, and sprayed it up good with automotive primer. It looks okay, but I have a feeling there is still some exposed metal on the back side. Any suggestions for making the repair as rust-resistant as possible? I haven't fabricated a patch yet, but that is the plan. I'll just sheet-metal-screw it in place with some goop in between to seal it. I'm just concerned about water splashing up into there through the few little holes that do access that compartment from the bottom, and corroding my floor. I don't really have good access to coat the back of the repair with anything though... Any thoughts would be appreciated.
For now, it'* just folded back, with the carpet back over it, and my wife has strict instructions not to drive in the rain.
While I was down there, I noticed one more missing washer, which I fixed. That one was the front of the two back ones on the opposite side. Those have some top access, so I hosed it down liberally with PB blaster a few hours ahead of time. That went smoothly.
A test-drive confirmed that the car was much more responsive to steering input (it was getting horrible, I knew something was wrong). Too bad a .5 hour project turned into a 4-hour (approximate) project, but at least it'* safe again. I'm just thrilled that I caught it before the power met the pavement in a very literal sense. It'* disturbing that a reasonably rust-free (for Michigan) '96 had this problem though! I'm all paranoid now.