[Entity Analytics] Fix toggle ignoring V2 store status when V1 experimental flag is disabled

[seanrathier]

Summary

Fixes the entity analytics toggle showing OFF despite the V2 entity store being fully running, when the entityStoreDisabled experimental flag is enabled alongside securitySolution:entityStoreEnableV2.

Root cause 1 — status derivation (use_entity_analytics_status.ts):
deriveEntityAnalyticsStatus checked isEntityStoreFeatureFlagDisabled before isEntityStoreV2Enabled. When entityStoreDisabled=true and V2 is enabled, the function short-circuited into deriveRiskEngineOnlyStatus, discarding the polled V2 running status entirely. The fix moves the V2 check first so it supersedes the V1 feature flag.

Root cause 2 — toggle action (use_toggle_entity_analytics.ts):
storeOn was computed as !isEntityStoreFeatureFlagDisabled && entityStoreStatus === 'running'. In V2 mode with entityStoreDisabled=true, this always evaluated to false, causing the toggle click to always try to enable the store (instead of stopping it when already running). The fix computes storeOn independently of the V1 flag when in V2 mode.

Closes https://github.com/elastic/security-team/issues/16767

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

• Low risk. This is a pure status-derivation and toggle-action fix. No data is written, no ES mappings changed, no API contracts altered. The only observable effect is that the toggle now correctly reflects the V2 store state when both flags are active simultaneously.

Release Notes

Fix entity analytics toggle displaying OFF when V2 entity store is running and the V1 entityStoreDisabled experimental flag is enabled.

[elasticmachine]

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies feature flag gating logic that determines whether entity analytics is enabled or disabled, changing the order of condition evaluation. All changed files are owned by @elastic/security-entity-analytics, which the author is not a member of, so the designated code owners should review these changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a9938ce

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	11.7MB	11.7MB	+53.0B

cc @seanrathier

[kibanamachine]

Starting backport for target branches: 9.4

https://github.com/elastic/kibana/actions/runs/24571559094

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

[kibanamachine]

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @seanrathier