docs: 'encrypt values' is documented as ComponentSecure scope, but returns ProjectSecure ciphertext

[padak]

Follow-up split out of #607 / PR #611.

Three agent-facing surfaces describe kbagent encrypt values as producing ComponentSecure ciphertext:

• plugins/kbagent/skills/kbagent/references/commands-reference.md:319 — "Scope: ComponentSecure (project + component)."
• plugins/kbagent/skills/kbagent/references/encrypt-workflow.md:21 — "All encryption uses ComponentSecure scope (project + component)."
• src/keboola_agent_cli/commands/context.py:1307 — same wording in AGENT_CONTEXT.
• plugins/kbagent/skills/kbagent/references/variables-workflow.md:78 — "receives KBC::ComponentSecure::..."

client/misc.py::encrypt_values sends both projectId and componentId:

params={"projectId": project_id, "componentId": component_id}

which makes the API return a ProjectSecure cipher, not ComponentSecure. Verified live:

• Azure (project 13775) → KBC::ProjectSecureKV::...
• AWS/GCP fixtures and E2E assertions in the repo → KBC::ProjectSecure::... (e.g. tests/test_e2e_auth.py:270)

The described scope ("project + component") is right — the value is bound to both. Only the cipher name is wrong, and it is the cipher name an agent will pattern-match on when it checks whether a value is encrypted, or when it hand-writes a ciphertext prefix into a config.

variables-workflow.md:78 is the most concretely misleading: it shows a literal KBC::ComponentSecure::... as the value kbagent receives.

Suggested fix: say "project-scoped (KBC::ProjectSecure::, KBC::ProjectSecureGKMS:: on GCP, KBC::ProjectSecureKV:: on Azure), bound to this project and this component", and point at the new gotcha added in #611.

Reference: https://developers.keboola.com/overview/encryption/