`check --references` passes a GRANT EXECUTE that fails at exec with CE0148 (cross-module role)

[MendixMau]

Environment: mxcli (RnD/upstream, commit 504aec6), Mendix 11.12.0 project (EmptyTest base).

Steps to reproduce:

create module ZKT27A;
/
create module ZKT27B;
/
create module role ZKT27A."Role1";
/
create microflow ZKT27B."MF_Test" () returns Boolean
begin
	return true;
end
/
grant execute on microflow ZKT27B."MF_Test" to ZKT27A."Role1";

Run mxcli check script.mdl -p EmptyTest.mpr --references, then mxcli exec script.mdl -p EmptyTest.mpr.

Expected behavior: Since Mendix module roles can only be granted access to microflows in
their own module, check --references should flag the cross-module grant statement up front
(same message class as the exec-time error), so users don't get partway through executing a
script before hitting the failure.

Actual behavior: check --references reports "All references valid" and "Check passed!"
with no mention of the cross-module constraint. exec then creates the two modules, the role,
and the microflow, and only fails on the final grant statement with:
cannot grant microflow ZKT27B.MF_Test access to ZKT27A.Role1: ... CE0148 "reselect roles".
This leaves the target .mpr with partially-applied changes from the script (module, role, and
microflow all created; grant not applied) since mxcli doesn't appear to run script statements in
a single transaction.

Separately: a community fork (engalar/mxcli) cannot even reach this statement — create module role alone throws failed to read module security for <module>: multiple Security$ModuleSecurity units for module <guid> on a completely fresh project. That looks like
a distinct, more severe regression worth its own issue against that fork, not a fix to port
here.