Tab the PC detail page, and let a panel say which tab it belongs to

The page had grown to roughly ten cards in one flow, and three more surfaces
were wanted on it: installed software, live metrics, and the service controls.
Stacking those into the same column would have buried what the page is for.

Tabs were mocked and rejected on 2026-08-28, on the grounds that the strip
duplicated the sidebar and cost hero space. That objection is answered by
where the strip sits: the hero and the triage band stay above it and never
move, so "is this machine OK" is still answered without a click, and the strip
partitions the detail underneath rather than navigating anywhere.

WHY A PANEL DECLARES ITS OWN GROUP

Most cards on a detail page are not the page's. They arrive through the
ADR-010 get_asset_panels hook, so a page that sorted panels into tabs by
knowing their ids would defeat the hook it is built on. Panels now carry an
optional group instead, and the page only knows the five group names.

Resolution happens server-side, in the asset-panels route, so that an absent
or misspelled group becomes 'details' before the client ever sees it. The
client renders known groups only; an unrecognised value that survived to it
would be a panel that exists and is displayed nowhere. Contract 0.28.0 ->
0.29.0, additive - every existing plugin keeps working untouched, and the
endpoints status panel is deliberately left ungrouped so the default path is
exercised by a shipped plugin and not only by tests.

A tab is offered only when something fills it. An empty tab reads as broken
rather than as "this site does not collect that", so the strip is built from
the groups that actually returned data, and a tab that disappears on refetch
falls back to Details rather than leaving the page blank.

AssetDetailTabs is core, not a PCDetail component: machines, printers,
network devices and measuring tools all have the same shape, and the shared
asset-detail shell they need starts here.

Scope: product

plugins/endpoints/plugin.py

@@ -351,6 +351,8 @@ class EndpointsPlugin(BasePlugin):
                 'permission': 'endpoints.command',
                 'empty': 'No monitored services reported.',
                 'position': 12,
+                # Start/Stop act on the machine, so this is a control surface
+                'group': 'actions',
             },
             {
                 'id': 'endpoints-tracked-processes',
@@ -389,6 +391,8 @@ class EndpointsPlugin(BasePlugin):
                 'permission': 'endpoints.command',
                 'empty': 'No monitored processes reported.',
                 'position': 13,
+                # observed process state, not something you act on here
+                'group': 'metrics',
             },
             {
                 # One feed instead of two cards. Events and commands answer the
@@ -432,6 +436,8 @@ class EndpointsPlugin(BasePlugin):
                 },
                 'empty': 'Nothing recorded for this endpoint yet.',
                 'position': 20,
+                # the event and command feed IS the activity tab
+                'group': 'activity',
             },
             {
                 'id': 'endpoints-interfaces',
@@ -451,6 +457,8 @@ class EndpointsPlugin(BasePlugin):
                 ],
                 'empty': 'No network interfaces reported.',
                 'position': 16,
+                # adapter state is telemetry, not something you act on
+                'group': 'metrics',
             },
             {
                 # Installed-software (SBOM) inventory. Low-priority reference
@@ -471,6 +479,8 @@ class EndpointsPlugin(BasePlugin):
                 ],
                 'empty': 'No installed software reported.',
                 'position': 30,
+                # the installed-software inventory
+                'group': 'software',
             },
         ]