Release v4.124.0

Added

• A reaction can declare the system identity its invoked commands run under: runs as system, optionally followed by role "<Role>" repeated with and. It prints after the description and before the first trigger and round-trips in both compilers, editors and MCP declaration-details. Until the identity is admitted into the executable model, binding a reaction that declares it reports PLAY0268; models without it are unchanged (part of #383)
• New diagnostics: PLAY0647 for a malformed, repeated or misplaced runs as or empty or duplicate roles, and warnings for a reaction invoking a gated command without an identity (PLAY0648), an identity on a reaction that neither invokes a command nor has an implementation body (PLAY0649), a declared role no invoked command needs (PLAY0650) and an identity that definitely cannot satisfy an invoked command's gate (PLAY0651) (part of #383)
• An opt-in privilege completeness check (PLAY0652) reports each producer of a reaction's trigger event that can cause an elevated reaction without holding the reaction's roles itself (part of #383)

Changed

• PLAY0557 no longer fires when the reaction declares runs as, and its message now names runs as system role as the remedy. The reaction documentation is corrected: Arc runs a reactor's commands as the system only when the reactor carries [ExecuteCommandsAsSystem] (part of #383)