create or modify everywhere: describe emits it, or replace is its alias under mdl 1, module role in createStatement (#731)

[ako]

Part of #731 (plan item 2.1, ADR-0010 R1). Tracking: #714.

What this does

• describe emits create or modify for every document type. Newly moved: JavaScript action, user role, layout, REST client, OData client/service, external entity, database connection, data transformer, agent/model/knowledge base/consumed MCP service, workflow, validation rule, module; navigation create or replace → create or modify.
• What that unmasked, fixed so the output really runs unchanged:
  • Security$ProjectSecurity.UserRoles/DemoUsers were re-encoded with marker 3; Studio Pro writes 2 (PedApp, TestApp and expr-checker agree). Registered.
  • JavaScript action rewrite now carries what describe cannot print, as the Java twin does: the "source not available" placeholder is not written as the .js source, and parameter Description/Category are carried by name.
  • carriedDocumentation: a doc comment that is exactly the stored text's normal form (no blank lines / trailing spaces / CRLF, which /** */ cannot spell) keeps the stored bytes.
• Allowlist shrinks: the whole Round-trip harness: untracked describe → exec losses on the Studio Pro fixture (microflows, entities, pages, snippets, menus, roles, JS actions) #721 F class (45 JavaScript actions, 2 user roles) is struck, plus the putget law of microflow Administration.NewWebServiceAccount (fixed by the doc-comment carry). 101 of 223 PedApp documents round-trip.
• create or replace under mdl 1 means create or modify on a view entity (identity-carrying rewrite instead of delete+recreate) and on user role / demo user (instead of a plain create); each is then a plain MDL-DEPR001 alias. Under mdl 0 the alpha meaning is kept and MDL-V1-REPLACE01 / MDL-V1-REPLACE02 warn (ADR-0011). Only translations stays exempt from the alias (it replaces the whole set).
• create module role is a createStatement kind (so or replace/doc comment work like everywhere else); drop module role if exists added. Docs/skill/help updated.

Design choices the ADRs did not settle

• The view-entity/role change is a change of meaning, so it is gated on the header rather than applied to headerless scripts; the language-change codes are MDL-V1-REPLACE01/02 (no convention existed yet beyond the MDL-V1-… example in visitor_language_header.go).
• GUID fixture: PedApp has no view entity, and Studio Pro's MCP cannot author one (mxcli mcp capabilities: view entities not authorable; no save tool). The ako/TestApp clone already has a Studio Pro-authored view entity, MyFirstModule.VCar (GUID != $ID on entity and attributes). New fixture testdata/testapp-views (360 KB) is that app trimmed to the project root + MyFirstModule units; README documents what was removed.
• create module has no modify behaviour (existing module is a no-op), so describe's create or modify module is just the canonical spelling.

Test plan (what I ran)

• make build, make lint (Go + TS) — pass.
• go test ./mdl/executor/ ./mdl/visitor/ ./mdl/grammar/ ./mdl/deprecation/ ./mdl/langver/ ./mdl/backend/... ./modelsdk/codec/ ./cmd/mxcli/ — pass.
• go test -tags integration ./mdl/roundtrip/ — pass with the struck allowlist (includes new TestViewEntityCreateOrModifyKeepsGUID).
• Manual round trip on a copy of the TestApp clone (describe → exec) for odata client/service, rest client, workflow, layout, JS action, external entity, user role, demo user, module role, published REST, navigation, module, entity, association.

Revert checks (each test fails with the fix reverted, passes with it):

• describe spelling: reversing the 15 emitter edits fails 18 describe tests (incl. new parse-based TestDescribe{JavaScriptAction,UserRole,Navigation}_EmitsCreateOrModify).
• TestProjectSecurity_UserRoleAndDemoUserListMarkers: markers 3 without the registration; control asserts the fixture has 2.
• TestJavaScriptActionBody_PlaceholderIsNotWritten, TestJavaScriptActionRewrite_CarriesParameterDescription: fail with guard/carry disabled; each has a control.
• TestCarriedDocumentation_KeepsStoredWhenOnlyTheSpellingDiffers failed before the change; reverting it in the harness makes NanoflowCommons.SignOut and NewWebServiceAccount fail again.
• TestViewEntityCreateOrModifyKeepsGUID: with the mdl 1 gate disabled, the mdl 1 case re-mints entity + attribute GUIDs; the mdl 0 or replace case is the control that proves the assertion detects a lost GUID; precondition asserts GUID != $ID.
• TestCreateOrReplaceMatchesModifyExceptExemptKinds now runs under mdl 0 and mdl 1; disabling the gate fails the three mdl 1 cases.
• TestDropModuleRole_IfExistsSkipsMissingRole: fails with the IfExists branch disabled; the plain drop is the control.

Not in this PR (follow-ups)

• if not exists on every document type (today entity/association only).
• create or modify user role is additive and ignores manage all roles on an existing role; R1 "make it match" semantics would be an mdl 1 change.
• Found while round-tripping TestApp: REST client describe prints Response: json without as $var (parse error); navigation describe output fails the reference check on System.Images.* icons; view-entity describe of an AutoNumber source column declares Long and fails the reference check; demo user describe prints password '***' which exec would store; JS action rewrite drops the .js EXTRA CODE section when the source is readable.

🤖 Generated with Claude Code

[ako]

Independent review. I pushed a9d617b (JS action: running unchanged describe output leaves the .js file alone). All unit, round-trip and lint checks pass on the branch, and I reverted each claimed fix to confirm its test fails without it.

Blocking: on main, describe printed a plain create for these types, and running that output was refused ("already exists"). With create or modify it now runs, and on the Studio Pro-authored ako/TestApp clone it silently rewrites the document with losses. I compared the BSON of each copy before and after one describe → exec:

• workflow workflow.Workflow1_2: EventSubProcesses removed entirely. Outcome Flows dropped. Activity names re-spelled (start1 → Start). Workflow1 loses the same things inside its event sub-process.
• external entity Clients.Orders: every attribute's Rest$ODataMappedValue becomes DomainModels$StoredValue, so the OData mapping (RemoteName/RemoteType/Filterable/...) is gone. Attribute $IDs are re-minted, and DateTime LocalizeDate is dropped.
• odata client Clients.OrderODataClient: UseQuerySegment true → false. ApplicationId, EndpointId, CatalogUrl, Icon, the proxy settings, ErrorHandlingMicroflow and HeaderListMicroflow are dropped.
• odata service MyFirstModule.CarOdataApi: EntitySet PageSize 10000 → 0 (describe only prints it with UsePaging). ExportLevel is dropped.
• demo user: the rewritten user moves to the end of DemoUsers. This is churn only.

The round trip cannot see any of this: unitKeywords has no mapping for these types, and PedApp has no workflow, OData or external entity. The PedApp JS actions all printed the placeholder body, so the .js path was never run either. The followup about demo user '***' is out of date: #707 already treats '***' as "keep the stored password".

Either each of these rewrites needs to carry what describe cannot print, or these types keep a plain create until that is done. Which one is a call for the maintainer.