Epic: Port keboola-mcp-server agent tools into native kbagent commands

[padak]

Context

kbagent already embeds keboola-mcp-server as a subprocess (services/mcp_service.py) and can proxy any of its tools through kbagent tool call <name>. So none of the tools below are unreachable today. The point of porting them to native CLI commands is:

• native --json + Rich dual output (the tool call passthrough returns the raw MCP payload),
• no MCP subprocess spawn (faster, one less moving part),
• discoverability in --help / kbagent context,
• no coupling to whatever keboola-mcp-server version happens to be installed.

This epic tracks porting a selected subset of keboola-mcp-server (compared at tag agent-v1.60.0, 37 tools) into first-class kbagent commands. Relates to #152 (Modern Agentic CLI).

Decided ports

• feat(docs): kbagent docs query — answer questions from Keboola documentation (port docs_query) #392 — docs_query → kbagent docs query — S
• feat(config): kbagent config examples — surface component config examples (port get_config_examples) #393 — get_config_examples → kbagent config examples — S
• feat(semantic-layer): kbagent semantic-layer schema — JSON schema per object type (port get_semantic_schema) #394 — get_semantic_schema → kbagent semantic-layer schema — S
• feat(component): kbagent component sync-action — run synchronous component actions (port run_sync_action) #395 — run_sync_action → kbagent component sync-action — S–M
• feat(transformation): kbagent transformation group — create + structured edit (port create/update_sql_transformation) #396 — create_sql_transformation + update_sql_transformation → kbagent transformation group (create + structured edit) — S + M
• feat(flow): kbagent flow examples + fix drifted flow schema (port get_flow_examples) #397 — get_flow_examples → kbagent flow examples (+ fix the drifted flow schema) — M

Explicitly rejected (for the record)

• query_data (ad-hoc read-only SELECT via implicit workspace) — kbagent workspace query already covers SQL execution; we don't want the implicit-workspace ergonomics in the CLI.
• validate_semantic_query — it is not a server endpoint but ~340 LOC of local best-effort heuristics (string-matching FQNs against SQL, no parser, no execution). Its value assumes an agent in the loop, it would drift from upstream as the MCP team tunes the heuristics, and it clashes with the existing model-validator semantic-layer validate. Deferred; revisit if there is real demand.

Cross-cutting requirement (applies to every sub-issue)

Per CONTRIBUTING.md and CLAUDE.md convention #17, each new/renamed command is not done until these silent-drift surfaces are updated in the same PR:

• src/keboola_agent_cli/commands/context.py (AGENT_CONTEXT)
• CLAUDE.md ## All CLI Commands
• plugins/kbagent/agents/keboola-expert.md (mind the ~62 KB byte budget — trim an adjacent block if needed)
• plugins/kbagent/skills/kbagent/SKILL.md
• plugins/kbagent/skills/kbagent/references/commands-reference.md
• plugins/kbagent/skills/kbagent/references/gotchas.md (tag new gotchas (since vX.Y.Z))
• relevant references/<topic>-workflow.md
• changelog.py entry (CI-enforced) + make version-sync
• E2E test in tests/test_e2e.py (convention Close must-have gaps in explorer command #16)

[padak]

Phase 1 of the #478 plan is implemented in #508 (0.73.0): all six subtasks (#392–#397) plus the phase-0 fail-closed firewall. When #508 merges, the remaining epic work is the deprecation track: parity map + deprecation warnings on tool call/tool list/agent --type mcp_tool (0.74.x), then passthrough removal, plus a CI canary diffing the mcp-server tool catalog against the parity map. query_data / validate_semantic_query remain intentionally unported (workspace query / semantic-layer validate are the CLI answers).

[padak]

Phase 2 is implemented in #509 (0.74.0, stacked on #508): parity map as code with offline registry-pinning tests, per-tool deprecation warnings on tool call (exact native replacement; additive JSON key), cli_equivalent in tool list, warnings on agent --type mcp_tool, /mcp/tools* marked deprecated in OpenAPI, and a weekly CI canary diffing the live mcp-server catalog (39/39 covered today) against the map. Remaining: phase 3 removal after the deprecation window.