List the workflow's variables (secret values never returned)

Workflow variables are constants exposed to expressions. They come in two kinds and they live in different places:

• Plain — stored inside the draft definition under variables. Returned here with their value. Because they are part of the definition, a change to one reaches production only when you publish.
• Sensitive — encrypted on the workflow row, OUTSIDE the definition (so publishing, exporting, duplicating or restoring a version can never carry a secret). Returned here by NAME ONLY: isSecret: true and value: "". There is no read path for a secret value, ever. A sensitive variable takes effect immediately, without a publish — you must be able to rotate a leaked key without shipping a draft.

secretsAvailable is false when the server has no encryption key configured; storing a sensitive variable will then be refused, so check it before offering the option.

Order is sensitive-first, then by name.