docs(cli): clarify --source scoping without --all-repos (#1624)

Without --all-repos, --source only searches the current repository.
The previous description implied project-wide fan-out when using
--source alone, which was inaccurate. The fix clarifies the scope
limitation and updates the example to show the correct combined usage.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

docs/cli.md

@@ -69,7 +69,7 @@ Global flags (apply to all subcommands): `--verbose, -v` (enable info-level logg
 `secrets set / list / delete` accept opt-in flags that activate **Preview-driven discovery** instead of the default lexical local-fixture matching. They are the surface that solves token management for templates that get included by other pipelines.
 
 - **`--all-repos`** — search every definition in the ADO project. With it, you can `secrets set GITHUB_TOKEN --all-repos` from anywhere; no local checkout of the consumer pipelines is needed.
-- **`--source <path>`** — filter results to definitions whose `# ado-aw-metadata` marker references that template. Useful for fan-out: `secrets set GITHUB_TOKEN --source agents/security-scan.md` rotates the token on every consumer pipeline that includes that template.
+- **`--source <path>`** — filter results to definitions whose `# ado-aw-metadata` marker references that template. Without `--all-repos`, only definitions in the **current repository** are searched. For project-wide fan-out, combine both flags: `secrets set GITHUB_TOKEN --source agents/security-scan.md --all-repos` rotates the token on every consumer pipeline that includes that template across the whole ADO project.
 - **`--include-disabled`** — also Preview `disabled` / `paused` definitions. By default these are pruned before the Preview fan-out: because discovery issues one Pipeline Preview call per in-scope definition, dropping inactive pipelines up-front is where the time is saved on large projects. Pass this flag (e.g. `secrets set GITHUB_TOKEN --all-repos --include-disabled`) when you need to operate on inactive pipelines too. Definitions without a reported `queueStatus` are always treated as active so nothing the API failed to annotate is silently skipped.
 
 Both `--all-repos` and `--source` route through `ado-aw`'s `discover_ado_aw_pipelines` machinery, which calls ADO's Pipeline Preview API per definition and scans the expanded YAML for an `ado-aw-marker` step that every compiled pipeline now carries. `--definition-ids` remains the explicit-ID escape hatch and is mutually exclusive with these flags. `enable`, `disable`, and `remove` are **not** changed — they retain their source-scoped safety semantics.