Agent modal: move Instructions after Actions and Knowledge, and add #action / #knowledge context references #1257

Summary

In the agent configuration modal the Instructions step is step 3, before Actions (step 4) and Assigned Knowledge (step 5). Authors therefore write instructions before they know which actions and which knowledge the agent will actually have.

This issue moves Instructions to after Actions and Knowledge, and uses that ordering to make the instructions authoring experience context-aware.

User Value

• Admins and workspace owners can write instructions that reference the actions and documents the agent really has, instead of guessing.
• Instructions can point at a specific action capability (for example the Simple Chat create_group operation) or a specific assigned document, so the agent gets much clearer guidance on when and why to use each capability.
• The Draft Instructions AI helper currently knows only the agent name, description, and brief. Giving it the selected actions, their enabled capabilities, and the assigned knowledge produces far more useful first drafts.

Proposed Behavior

1. New step order

Basic Info → Model & Connection → Actions → Knowledge → Instructions → Advanced → Summary

2. "Selected Actions & Knowledge" reference panel

A collapsible card at the top of the Instructions step listing the selected actions with badges for their enabled capabilities, plus the assigned knowledge workspaces, documents, tags, and web sources, with a short hint showing the token syntax.

3. # autocomplete in the Instruction Brief and the instructions editor

Typing # opens a menu offering the action and knowledge namespaces, then drills down:

• #action: lists the actions selected in the Actions step. Actions that have sub-capabilities (Simple Chat, Microsoft Graph, Chart) open a third level listing only the enabled capability keys.
• #knowledge: lists documents, workspaces, tags, and web sources in one merged alphabetical list with type badges.

Navigation via arrow keys, Tab/Enter to select, Esc to dismiss, plus mouse hover and click.

Token grammar (stored literally in the saved instructions so they stay editable):

#action:<ActionDisplayName>
#action:<ActionDisplayName>:<capability_key>
#knowledge:doc:<Document Title>
#knowledge:workspace:<Workspace Name>
#knowledge:tag:<tag>
#knowledge:web:<url>

Values containing a space or colon are inserted wrapped in double quotes, for example #knowledge:doc:"Employee Handbook.pdf".

4. Context-aware Draft Instructions

POST /api/agents/draft-instructions also receives the selected actions with their enabled capabilities and the assigned knowledge configuration. The prompt is updated so the drafted instructions reference only real, selected actions/capabilities/documents and use the token convention.

Acceptance Criteria

• Modal step order is Basic Info, Model & Connection, Actions, Knowledge, Instructions, Advanced, Summary
• Step navigation, validation, and Foundry agent-type visibility behave correctly under the new order
• The Instructions step shows a collapsible panel of the selected actions (with enabled capabilities) and assigned knowledge, including empty states
• # autocomplete works in both the Instruction Brief textarea and the main SimpleMDE instructions editor
• #action: offers only actions selected in the Actions step, and only their enabled sub-capabilities
• #knowledge: offers assigned documents, workspaces, tags, and web sources with type badges
• Tokens are stored literally in the saved instructions and round-trip unchanged when editing an existing agent
• Draft Instructions receives and uses the selected actions and assigned knowledge, and emits the token convention
• Client-supplied action/knowledge context is sanitized and size-capped on the backend and is never used for authorization
• Feature documentation and release notes added, config.py version bumped
• Functional tests cover the step order, the token grammar and XSS-safe rendering, and the draft-instructions prompt context

Notes

• The instructions editor is SimpleMDE 1.11.2, vendored locally. That bundle does not ship CodeMirror's show-hint addon, so the autocomplete menu is implemented as a local module positioned with codemirror.cursorCoords(). Per the repo's local browser assets rule, no CDN assets are introduced.
• Actions load when the Actions step is opened and the knowledge catalog loads when the Knowledge step is opened, so both data sets are available by the time Instructions is reached.
• Foundry agent types manage instructions and tools in Foundry, so the panel, autocomplete, and draft button stay inert for those types.
• Stale tokens (referencing an action or document that was later deselected) are intentionally left in place rather than auto-removed; highlighting/validating them is deferred to a follow-up.