Sync ako/mxcli: workflow authoring — end workflow, signature checks, rewrite guards

[ako]

Nine commits from ako/mxcli:main, all workflow, in three groups. Follows #1095 and the Mode 2 sync; upstream is at v0.22.0.

The theme across all three: a team building workflows from MDL listed several reasons "a green CLI check is not evidence for workflows". Each group closes one of them, and every rule below is a row of an mxbuild measurement rather than a reading of a CE code.

check was resolving workflow references by name only

• fix(check) — a user task's page and targeting microflow signatures. A task page typed to the context entity, one with no parameters, or a targeting microflow missing the System.Workflow parameter passed check --references, was written by exec, and failed only in the native build. Every rule is one user task per shape on 11.13.0, verdict = the literal mx check line:

  shape	verdict
  task page, no parameters	CE7410
  task page, no WorkflowUserTask parameter	CE7412 (multi-user too)
  task page, WorkflowUserTask + an extra parameter	0 errors
  targeting (System.Workflow, Ctx) / (Ctx, Workflow)	0 errors
  targeting (Workflow) / () / (Workflow, Ctx, String)	CE6677
  targeting (Workflow, generalization of Ctx)	0 errors
  targeting (Workflow, specialization of Ctx)	CE6677

• fix(check) — stop telling a workflow statement to move before itself. Every error naming the workflow being created ended with "hint: M.W is defined later in this script — move its create statement before this one". annotateForwardRef draws candidates from scriptContext.allNames, which includes workflows, and excludes anything already created through scriptContext.has, which answered for every kind a script can create except workflows. Two lists over the same kinds with nothing keeping them in step. It surfaced through the signature errors above, but any workflow reference error had it.

• test(workflow) — the round-trip fixtures had never been valid task pages or targeting microflows; they only compared describe output, so nothing had built them. The unit suite could not have caught it either: the rule is gated on the project version and the mock projects have none.

• docs(workflow) — the two signatures written down.

end workflow — ending a workflow from inside a branch

• feat(workflow) — end workflow [comment '<caption>']; is legal in any { } block and ends the whole workflow: the counterpart of a microflow's return, which in a workflow body is now refused with a pointer to it (MDL-WF11) and refused by exec rather than dropped, since a dropped return falls through.

  The first workflow grammar dropped the statement for colliding with the closing END WORKFLOW. That collision exists only at the top level — the one place Mendix refuses an explicit End — so the top-level body is its own rule and brace bodies are walked in child order.

  Placement rules, each an 11.13.0 measurement with the real syntax, all checked without a project:

  placement	verdict	rule
  under a parallel split or non-interrupting boundary, any depth	CE1844	MDL-WF08
  anything after it in its block	CE6671	MDL-WF09
  every path of an activity ends (End or jump, incl. via a nested decision) with more after it, or as the main flow's last activity; and a main flow ending in a direct jump	CE6689	MDL-WF10

• docs(proposal) — the design behind it.

Rewrites that silently reset what Studio Pro configured

• fix(workflow) — refuse them. Measured on a Studio Pro reference workflow (11.14.0, 0 errors under mxbuild): ALTER WORKFLOW … REPLACE ACTIVITY with an identical user task reset the task's on-created microflow (MicroflowBasedEvent → NoEvent) while exec reported "Altered workflow". SET ACTIVITY, which edits the stored document in place, kept it — the control that pins the loss on the rebuild. Every rebuild writes a default for what MDL has no spelling for (OnCreatedEvent, OnWorkflowEvent, CompletionCriteria, and an AI agent task describe only prints as a comment), none of it guarded, so create or modify lost it the same way. Both now refuse, listing every reason at once.
• fix(workflow) — boundary events on a wait for notification. Two defects behind one round trip: the default engine had no typed case for it, so it fell to the untyped path (name and caption only) and describe dropped every timer and its handler flow, while the legacy engine described them — gen has had the typed struct for some time and the fallback's "no genWf struct" comment had gone stale. And describe output with two boundary events did not parse on either engine: describe writes the keyword before each event, as the syntax topic documents, while the grammar took it once. The grammar now accepts both spellings.
• docs(changelog) — the two above.