Sync ako/mxcli: filemanager widget, no auto-created module roles, describe round-trip fixes

[ako]

Syncs ako/mxcli:main into mendixlabs/mxcli:main: 42 commits since #1478, landed in the fork through PRs ako#1176–ako#1213. Most fix reported describe → exec round-trip failures on Studio Pro-authored apps and templates.

Behaviour changes

• A new document never auto-creates a module role (auto created module role is potential security issue #1474). A new page, microflow or nanoflow in a module with no roles used to create <Module>.User and grant itself to it: a security role nobody chose. New documents now start with no allowed roles, and MOVE maps roles to same-named targets without creating any. Scripts that relied on the implicit role must create it.
• Forward microflow/nanoflow calls resolve within a run (Describe emits catalog order; exec and check refuse forward and cross-module references, so mutual recursion cannot be created #1405), so mutually recursive flows round-trip. This is safe now that exec rolls back on failure (Exec is not atomic after the pre-check passes #1408).

New MDL

• filemanager widget for the classic Forms$FileManager (Support FILEMANAGER classic widget in MDL page creation #151): create, describe, ALTER SET its own properties, and refuse it outside a System.FileDocument context (MDL-WIDGET45, CE6810). Verified in the running app with a Playwright upload test (size and extension limits).
• += / -= inside CHANGE for reference-set Add/Remove members alongside other members (MDL change object add/remove not supported #1473).
• create java action M.Name<T, U>(…) declares type parameters that no entity selector names (Java action type parameters are not expressible: describe emits MxObject: "Entity" with no declaration, and exec writes entity .Entity (CE1613) #1404).
• Published REST service authentication parameters are stated and described (Describe of a published REST service omits its authentication parameter list; the matching $Token microflow is then refused (MDL-REST04) #1417).
• Image: $currentObject binds the pluggable Image widget to an uploaded image (No MDL form binds the Image widget to an image object; dynamicimage fails CE0582 in React apps #1476), and set (Image: …) works on legacy image viewers (alter page … set (Image: …) is refused on a static image ("not a property of this built-in widget") #1464).
• layout --only-overlapping, and new entities are placed clear of tall ones (Domain model: entities with many attributes overlap the one below, mxcli layout assumes a centred position, and there is no repair that keeps hand-placed entities #1479).

describe → exec round-trips

• Enum splits with more than 16 branches (Create refuses an enum split with more than 16 branches that describe produced #1416). A case on a rule returning an enumeration (Describe of a merge/decision cannot be re-created (#923): WARNING lines, layout drift #1414).
• An index on a system date member (changedDate / createdDate) (Describe entity emits index ( desc); with no column #1401).
• Doc comments are guttered on every line, so markdown bullets survive (Describe of a doc comment loses a markdown * bullet #1428).
• A $var/Attr text-template parameter is stored as an expression (ContentParams parameters are described as $obj/Attr paths, which check refuses #1406). DecimalPrecision: -1 and a primitive-array mapping root parse (Three describe outputs check cannot parse: import-mapping root (Wrapper), dynamic-text format (decimalPrecision: -1), text box DecimalPrecision: -1 #1407).
• show page may pass the page's own parameter by name (Describe emits a show page argument taken from the page's own parameter, which check refuses (MDL-PAGEARG01) #1403). A data view over an unsupported selection source is commented out instead of emitted broken (Describe emits a selection data source naming a widget it did not emit #1415).
• The Mendix 9.x pluggable database source (Describe prints a nanoflow data source/action without its argument mapping #1399), with no false "NOT SHOWN" note on a reproduced content slot.
• Layouts built on another layout (describe layout prints an empty body for a layout that wraps another layout; the output is refused with declares no placeholders at all #1411), and a layout's stored canvas size is kept on rewrite.
• A tab page's Visible: is written, and what a tab page cannot store is refused (Tab page CaptionParams and Visible: pass check and exec, then are silently not written #1465).
• Multi-hop association data sources write one step per hop (Two-hop association data source on a data view: the DESCRIBE form writes the association as an entity (CE1613), the full form crashes the mxbuild loader #1467). DataGrid2 column insert/replace resolves a flow-sourced entity (Data grid 2 custom-content column loses its Attribute on grids with a microflow or nanoflow data source (alter page replace) #1468).
• Quoted names are stripped in multi-predicate retrieve constraints and whitespace-suffixed expression slots, where they were silently false constraints or CE0117.

Identity and safety

• An index GUID is carried when the declared index ID misses, so CREATE OR MODIFY ENTITY no longer trips the storage-GUID guard (create or modify entity on a Studio Pro-authored entity with an index is refused at exec (index GUID not carried over); check does not predict it #1470).
• Excluded-twin names resolve to the live document everywhere: show access, grant/revoke, drop page and alter page (Two pages with the same qualified name (one excluded): commands resolve the name to different copies, and there is no way to pick one #1469). Before, drop page could delete the live page.

Other

• .mpk packages with a data-descriptor CRC quirk are read, as Studio Pro and unzip do (False 'zip: checksum error' for a valid widget package (PopupMenu.mpk) #1488).
• Rollback message grammar ("statement 1 was rolled back"), skill index regeneration, and roundtrip allowlists narrowed where pages now round-trip