feat(standards): fix F11-F16 and rebuild bundle (43 components) + trial findings

- F11 PopulateRule field_name/collection_name corrections
- F12 service adaptor update handles PopulatingRepository
- F13 nested-references section; F14 authless /users/me guidance
- F15 template ruff-clean; F16 stop vendoring .ruff_cache, ship .gitignore
- document --template-style in build_recipe/spec_first_routing; refresh collected
  openapi-first + standards bundle (12 modules, 43 components)
- add trial.md and trial_findings.md (F1-F16, re-trial A/B evidence)

trial.md

@@ -0,0 +1,58 @@
+# Trial: build an Aetos app from the Standards blueprint (self-run, no auth)
+
+You are a zero-context builder. Test the Aetos *standards* by reproducing the
+reference app "khata-app" WITHOUT auth into `apps/khata-trial`, using ONLY the
+standard. You may consult the existing khata-app repo ONLY as the answer key to
+the intake questions below. Never copy its implementation code.
+
+## Sources of truth (read these first)
+- Standards MCP: http://localhost:8009/mcp
+  tools: find_library, list_app_components, get_app_component
+  resources: docs://nav, docs://modules/{module}, registry://libraries, registry://components
+  prompt: start_app
+- Tier A library MCPs (read a library's own docs before using it):
+  openapi-first :8004, mongo-ops :8007, hexa :8008, dagpipe :8006,
+  omniread :8003, mail-intake :8002, py-jwt :8005, doc-forge :8001
+- Standard docs: docs://modules/build_recipe, docs://modules/genericity_matrix,
+  docs://modules/layering_rules
+- If a server is not running, start all of them from the `aetos/docs` checkout:
+  `.venv\Scripts\python.exe main.py`
+
+## Step 0 — Intake (ask yourself the standard's questions)
+1. App name + one-line purpose
+2. Axis 1 — resources: each resource, fields, relationships (or paste openapi.yaml)
+3. Axis 2 — pipelines: multi-step inputs? families + formats (or none)
+4. Auth needed now? (yes/no)
+5. Integrations: Mongo / ingestion formats / email / LLM provider
+
+## Step 1 — Answer the intake from khata-app ONLY (answers only)
+Resolve each answer from these artifacts, and nothing else:
+- resources + fields + relationships + operationIds  <- openapi.yaml (schemas + operationId names)
+- pipeline families + input formats                  <- directory layout under pipelines/ (+ each pipeline.yaml name)
+- integrations                                       <- pyproject.toml deps + .env.example variable names
+- auth                                               <- the GLOBAL `security` block in openapi.yaml (this trial: NONE)
+Do NOT read or copy khata-app implementation modules. Write the answers down first.
+
+## Step 2 — Build (follow the standard)
+Follow docs://modules/build_recipe step by step:
+- Scaffold from the standard template. Prefer pulling files via get_app_component;
+  fallback: copy <docs>/standards/src/templates/app into apps/khata-trial.
+- Author openapi.yaml for the resolved resources, OMITTING auth (no global
+  `security`, no bearer scheme).
+- Author every CRUD slice; wire the composition root; add thin routes; bootstrap
+  app + worker; add pipeline families; add tests and operator scripts.
+- Tier A = call the library (never reimplement); Tier B = copy the template;
+  Tier C = author.
+
+## Step 3 — Verify and report
+- python -c "import main" succeeds
+- pytest passes
+- every no-auth khata-app operationId is served  -> report matched / missing
+- no domain/ module imports fastapi/starlette; no Tier A library reimplemented
+
+## Step 4 — Report standard gaps (primary output)
+List every point where the standard was insufficient, wrong, or missing: a file
+the docs said to copy but that didn't exist, an MCP tool that couldn't retrieve
+a needed file, an intake question that wasn't answerable, etc.
+
+Output: apps/khata-trial