Reorder workspace section tabs into a consistent order of operations

[Paul Lizer (paullizer)]

Fixes #1255

What this does

Workspace sections were ordered differently on every surface that listed them, and none of those orders communicated how the pieces relate. This adopts a single canonical order everywhere:

Documents → Prompts → Identities → Sync → Endpoints → Actions → Agents → Workflows

Each section depends on the ones before it, so the list now reads as how a workspace is actually built up: Identities feed both Sync and Actions, Endpoints feed Actions and Agents, Agents assemble everything, and Workflows run Agents. This came out of user and admin confusion about those relationships.

Sections still appear only when their existing feature gates are enabled — disabled ones simply close up while the rest keep their relative positions.

Before / after

Surface	Before	After
Personal tabs	Documents, Sync, Identities, Prompts, Agents, Actions, Workflows, Endpoints	canonical
Personal Section dropdown	Documents, Sync, Identities, Prompts, Agents, Actions, Workflows, Endpoints	canonical
Personal sidebar submenu	Documents, Prompts, Workflows, Agents, Actions, Endpoints, Sync, Identities	canonical
Group tabs	Documents, Sync, Identities, Prompts, Workflows, Agents, Actions, Endpoints	canonical
Group Section dropdown	Documents, Sync, Identities, Prompts, Workflows, Agents, Actions, Endpoints	canonical
Group sidebar submenu	Documents, Prompts, Agents, Actions, Endpoints, Sync, Identities (no Workflows)	canonical

Public workspaces already satisfied the canonical relative order (Documents → Prompts on the browse page, Identities before Sync on the manage page) and are unchanged.

Sidebar gating bugs fixed

The sidebar used visibility rules that didn't match the tabs they linked to, so a link could appear for a section that was never rendered:

Navigation item	Before	After
Personal → Your Agents	per_user_semantic_kernel and enable_semantic_kernel	+ allow_user_agents
Personal → Your Actions	per_user_semantic_kernel and enable_semantic_kernel	+ allow_user_agents and allow_user_plugins
Personal → Identities	... or enable_multi_model_endpoints	matches tab gate
Group → Group Agents	allow_group_agents and enable_semantic_kernel	+ per_user_semantic_kernel
Group → Group Actions	allow_group_agents and enable_semantic_kernel	+ per_user_semantic_kernel and allow_group_plugins
Group → Identities	... or enable_multi_model_endpoints	matches tab gate
Group → Group Workflows	missing entirely	added, gated by allow_group_workflows

The group sidebar had no Workflows entry at all, so group workflows were unreachable from the left-hand navigation despite the tab having shipped.

Implementation notes

Tab panes are deliberately not reordered. Bootstrap resolves panes by id / data-bs-target and hides inactive ones, so pane DOM order has no visual or accessibility effect. Leaving them in place keeps the diff reviewable — group_workspaces.html alone is ~389 KB.

Gate restructuring preserves effective conditions. Moving Actions ahead of Agents and Endpoints ahead of both required unwinding nested Jinja conditionals. For example, personal Actions was nested inside the Agents gate; it still requires per_user_semantic_kernel, enable_semantic_kernel, allow_user_agents, and allow_user_plugins — only its render position changed.

The dropdown and tab strip must move together. workspace_section_switcher.js maps option values onto tab button ids rather than deriving one from the other, so both were updated in lockstep.

Validation

• New functional_tests/test_workspace_section_order.py renders each of the six section lists through Jinja and asserts: the canonical order when everything is enabled; that disabled features only remove sections (never reorder or duplicate); and that the tab strip, Section dropdown, and sidebar submenu expose an identical set of sections across every combination of the eight relevant feature flags per scope (512 renders). It also checks the permission-aware group Identities markers survived the move, and that public workspaces still conform.
• Verified non-vacuous — the new test was run against the pre-change templates and fails there on all three order/parity assertions.
• No regressions — all 74 functional tests referencing the edited templates produce an identical failure set to the Development baseline (re-verified after rebasing). The 50 failures in that set are pre-existing and unrelated (stale assertions about app.py route registration, admin_settings.js helpers, hardcoded old version numbers, etc.).
• functional_tests/route_tests/ passes 12/12.
• All 50 templates parse cleanly through Jinja.
• test_endpoints_tab_order_visibility.py updated for the new Endpoints → Actions → Agents order; its pane assertions reduced to presence-only.

Also included

• Version bumped to 0.250.211 — rebased twice past Development, which claimed 0.250.209 (Cosmos backup fixes, Fix Cosmos backup continuation token failure dropping large containers #1259) and 0.250.210 (chat document search, Match chat document search on file names and clear dropdown divider artifacts #1260) while this was in flight
• docs/explanation/features/v0.250.211/WORKSPACE_SECTION_ORDER.md
• Release notes entry under User Interface Enhancements and Bug Fixes

Follow-ups (tracked in #1255, not in this PR)

• Visual grouping of sections — dividers or group labels (e.g. Content / Connections / Automation) building on this ordering
• Orphan #group-settings-tab pane in group_workspaces.html with no corresponding nav button anywhere in the codebase