Create a MODEL (idcompany IS NULL, template_key set) and fan it out.

This is what create_role's docstring used to say could not be done, and both of its reasons are answered rather than waived:

• "a template minted from a dialog has an empty Z_RolePermissions" — modules is required and non-empty, validated against MODULE_KEYS, and written in the same transaction as the template row.
• "the console cannot re-create templates", i.e. a mistake is unrepairable — DELETE /roles/{id}?delete_template=true now removes a console-created model together with its whole family, atomically, while nobody holds it.

The response names every company that did NOT get a copy and why. skipped is not an error path: a tenant that already owns a role with this name cannot have the copy (UX_Z_Roles_company_name), and refusing the whole template over one tenant's naming choice would make the feature unusable for exactly the generic names it is for. Retry that company with POST /roles/{id}/copies once the collision is resolved.