fix(app): order help sections consistently

[Pybsama]

Change summary

Fixes #1656.

This makes the help hierarchy consistent by displaying command-specific
sections before shared global flags:

• compact help now shows required/optional flags, arguments, and commands
  before global flags;
• verbose help now shows arguments and subcommands/commands before global
  flags;
• the auth guide and See Also footer remain after global flags.

The change only reorders the existing text templates. Flag classification,
command definitions, and JSON help output are unchanged.

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes to Core Features:

• Have you written new tests for your core changes, as applicable?
• Have you successfully run tests with your changes locally?

Testing

• GOTOOLCHAIN=go1.25.7 go test -race -run '^TestHelpSectionOrder$' -count=50 ./pkg/app
• GOTOOLCHAIN=go1.25.7 go test -race -shuffle=on -count=10 ./pkg/app
• GOTOOLCHAIN=go1.25.7 make all

User Impact

Users see the same command-specific-first ordering in compact and verbose help,
while all existing help content remains available.

Are there any considerations that need to be addressed for release?

No breaking changes or special release steps.

[Pybsama]

Revalidated this draft against current main (04ae88bca60e0ec72b8dacad1978d24a0428e25b, 26 commits after the PR base).

The implementation and test hunks still apply cleanly and their final blobs are identical to the public PR. The only textual conflict is CHANGELOG.md, because the original Unreleased section has since moved through the v15.5.0, v15.6.0, and v16.0.0 releases; I placed this entry under the current Unreleased / Bug Fixes section.

Current-main regression evidence:

• Adding the five help-order tests to unpatched current main produces four expected failures (compact/verbose root and category help) and one compatibility pass (compact leaf help).
• The resolved tree passes all 5/5 cases, plus 50 consecutive race-enabled repetitions.
• go test -race -shuffle=on -count=10 ./pkg/app passes.
• With Go 1.26.5 and the repository-pinned golangci-lint v2.4.0 installed, make all passes: formatting, all 20 enabled linters (0 issues), Semgrep 1.172.0 (1,073 rules / 1,403 tracked targets / 0 findings), the full repository race suite, build, and isolated install.
• go vet ./... and CGO-disabled Linux/Windows amd64 builds pass.
• Real CLI output was checked for compact/verbose root, category, leaf, auth-guide, and positional-argument paths; command-specific sections precede Global Flags, while Global Flags remain before AUTH GUIDE and SEE ALSO.

The resolved local commit is 3bc38965a2f8ed36ebc59921fd804c550787e39a (tree cc057db210e9548d450354e58055968f0937d8fd). The standard suite continues to skip the repository's opt-in external Compute scenarios, as documented by those tests.

I attempted an exact force-with-lease update from the unchanged public head 2367c383538b1faffa792fb3203a05d9fa5a5c89. GitHub rejected it before writing because current main modifies .github/workflows/merge_to_main.yml and the existing OAuth token lacks the workflow scope. I did not broaden credentials; the public branch and PR head remain unchanged. I am keeping the PR in Draft while the published head is still conflicting.