describe output that does not re-parse or loses data; configuration describe leaks DatabasePassword

[ako]

Plan item 0.3 in PROPOSAL_mdl_beta_syntax_freeze.md, §2 items 8–10.

describe output that does not re-parse or loses data

• Unescaped quotes. A string default containing ' is emitted unescaped (cmd_entities_describe.go:321). So are:
  • module-role descriptions (cmd_security.go:787);
  • OData service and published REST Folder, Path, Namespace, Summary and Version (cmd_odata.go:335-353, cmd_published_rest.go:103-112);
  • REST client BaseUrl and Path (cmd_rest_clients.go:125,156).
• Agent MCP-service blocks miss a comma between Enabled and Description (cmd_agenteditor_agents.go:179-181), so the output is a parse error.
• REST client header expressions ($var, 'Bearer ' + $T) are re-emitted as quoted literals (cmd_rest_clients.go:180).
• Demo users are emitted as password '***' (cmd_security.go:826). Re-running that sets the password to ***.
• User-role Description and CheckSecurity are printed only as -- comments (cmd_security.go:865-872). A user role with no module roles is emitted as create user role X;, which does not parse.
• Workflow captions and annotations are printed as -- comments (cmd_workflows.go:263-270,832,929,952), so they are lost on re-run.

Leaks and portability

• Configuration describe prints DatabasePassword = '<plaintext>' (cmd_settings.go:976), which leaks into PR diffs.
• Image-collection describe emits /tmp/mxcli-preview/... paths (cmd_imagecollections.go:158).

Each fix needs a round-trip test. Follow /mxcli-dev:fix-issue.