[ako]

Syncs ako/mxcli:main into upstream: 8 commits since #1781 — exec no longer leaves a project half-written after a timeout, plus marketplace, lint, run and catalog fixes.

exec: a timed-out or panicking statement is rolled back

• The rollback runs. A statement that outlasted the per-statement limit kept running after Execute returned the timeout. exec then closed the project to roll back, the abandoned statement read through the now-nil reader, and the panic in its goroutine ended the process before the rollback — leaving every earlier statement written. Close now waits (bounded) for a statement the guard gave up on, and a panic in a statement is that statement's error, so the script rolls back as for any other failure.
• The timeout itself is much rarer. Looking a unit up by name read and decoded every unit of its type on each call, and a flow build resolves each call microflow target that way, so one large flow in a large project cost callees × microflows unit reads. The first scan now records where each qualified name is; a later lookup reads that one unit and re-checks its name, $Type and module, so a unit changed outside mxcli is never served stale.

Fixes #1780

Marketplace: managed Java dependencies on install

A module such as MCP Client 4.4.0 declares Maven dependencies that Studio Pro downloads into vendorlib/ on import; a headless install copied only the declarations, so mx check passed and the build failed compiling Java actions. install and update now run the sync, and print the retry command when it fails. Two sync defects fixed on the way: a version range ([2.21.2,3)) was looked up as a file name, so a successful sync reported it missing and run --local re-synced on every boot; and one transient "Failed to find some hosts" ended the sync (now retried once).

lint

• SEC013: the security level ignores the project's rules. A blank app ships at security level Off (no entity access, page or microflow grant, no demo user); Prototype applies no entity access. SEC010–SEC012 only run at Production, so every gate passed while all rows were readable. SEC013 counts what the project's own modules define that the level ignores. The manage-security skill now says up front that a blank app ships Off.
• ARCH001 exempts System.Workflow*. A task page must take a System.WorkflowUserTask parameter (CE7410/CE7412), and complete task / open user task only work inside one (CE1843), so the advice to use a view entity or microflow had no way out.

run --test-endpoint

• No second build right after boot. The boot build creates themesource/MxTest/, which the watcher then saw as edited theme source: ~30 s of 404s on dist/pages and a forced client reload right as run --detach returned. A themesource folder a build creates is that build's output. Measured on a blank 11.12.6 app: main rebuilt every boot, this stays on the first build.
• The generated RegisterTestEndpoint.java is git-ignored (/javasource/mxtest/ and .mxcli/), so a git add -A while the endpoint is hosted no longer commits it; init's template carries the entries too.

Catalog: refs edges for entities named as a type

A result variable's type, a created list, an entity-type Java/JavaScript argument, a snippet parameter and the entity an association step arrives at had no refs edge, so show references, impact and the unused-entity check missed the reader and an incremental build didn't rebuild it; a missing enumeration value made no edge either. These now emit type, parameter, member, xpath and value edges, and annotation captions, translations and module-role names are no longer read as references. Ref coverage is 100% on two real apps (65 and 42 uncovered before). Catalog schema 37