Fixes owner-noun wording after the Scope rename

[johnnyt]

Two wording fixes left after the Scope rename (ADR-0009), in one PR. Wording only: no code, no public name and no wire spelling changes.

enc-gf3j: two stale owner-noun mentions

• Encryptor.Envelope.provision/3's doc said scope_ref/2's signature was amended at acceptance. At acceptance the function was tenant_ref/2 (ADR-0003's Status line says so); the sentence now names the reference function and says it was tenant_ref/2 then and ADR-0009 renamed it scope_ref/2.
• bench/bounds.exs's context-cost comment named a :tenant vault, a profile that is :scoped since ADR-0009. The comment and its two row labels now say scoped; the "tenant_ref" context key stays as spelled and the comment names it as the pinned v1 wire key.

enc-bw8: "scope" in derive's docs

derive/3's docs used "scope" both for the key's owner and for the derivation inputs. The derive doc now says that in its text a scope is always the key's owner and names the derivation inputs separately, calls :info a separation string whose empty value is legitimate, and notes that ADR-0003 amendment A's word for :info is "scope" in the derivation's sense. The Encryptor.Kdf.salted_subkey/5 doctest prose and the Encryptor.Vault.Derive comments drop the derivation sense and the "goes out of scope" idiom. Sentences where scope already meant the owner (a per-scope vault, a scope's index key and master key) are unchanged.

Review (in-turn)

Re-read the diff against both beads' acceptance. Checked by anchor on this branch: ADR-0003's Status line names the tenant_ref/2 signature amendment; ADR-0009's Context names the former :tenant context profile and the tenant_ref/2 function; Encryptor.Vault.Config accepts :single and :scoped profiles; ADR-0003 amendment A decision 4 says an empty info is a legitimate scope; Encryptor.Vault.Derive.call/3 passes purpose, info and length to Encryptor.Kdf.salted_subkey/5. No persisted or serialized string moved: the "tenant_ref" key, the "encryptor/v1/tenant-ref" label and the "tenant-ref" purpose appear unchanged. No test asserts the changed prose, and no bench output is read elsewhere in the repo.

Provenance

• The bead named the bench comment only; its two row labels changed with it so the comment's "scoped rows" names rows that exist.
• No changelog fragment: documentation is excluded by changelog.d/README.md.

Gate

mix quality green on the committed tree rebased onto main (all stages, Docs and Doc links included; 671 of 671 tests).

Refs: enc-gf3j, enc-bw8