[do not review] Fix popup tab focus navigation

[Adam Ratzman (adamint)]

Description

Fixes #17469.

Adds opt-in Aspire popup keyboard navigation for menu and filter/URL popover surfaces so Tab, Shift+Tab, and Escape move focus predictably instead of relying on Fluent UI's shadow-DOM anchored focus calculation. The fix is scoped to Aspire-owned popups used by View options and filter/overflow popovers.

Evidence: https://github.com/adamint/aspire/tree/a11y-artifacts-20260601042635/17469

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[Adam Ratzman (adamint)]

Captured evidence for this issue:

• Evidence folder: https://github.com/adamint/aspire/tree/a11y-artifacts-20260601042635/17469
• Root-cause before video: https://github.com/adamint/aspire/blob/a11y-artifacts-20260601042635/17469/root-cause-before/17469-root-cause-before.webm
• Root-cause after video: https://github.com/adamint/aspire/blob/a11y-artifacts-20260601042635/17469/root-cause-after/17469-root-cause-after.webm
• Root-cause before screenshot: https://github.com/adamint/aspire/blob/a11y-artifacts-20260601042635/17469/root-cause-before/17469-root-cause-before.png
• Root-cause after screenshot: https://github.com/adamint/aspire/blob/a11y-artifacts-20260601042635/17469/root-cause-after/17469-root-cause-after.png

I could not reproduce the visible reset in the current live dashboard build used for comparison, so the artifact folder also includes the live dashboard focus-sequence captures. The root-cause videos show the Fluent popup focus-wrap failure mode and the fixed Aspire popup navigation behavior.

Draft fix PR: #17793

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17793

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17793"

[Adam Ratzman (adamint)]

I verified the View options repro in a real browser with Playwright against main and this PR. Repro host was the dashboard mock app with TestResource plus TestResource child.

Steps: open Resources > View options, press Tab to move to Collapse child resources, press Tab again, and inspect the active element plus whether the menu is still present. On main, the second Tab collapsed the menu and focus landed on the Aspire logo. On this PR, the menu remains present after that second Tab.

Proof:

{"pr":"17793","phase":"base","active":{"aria":"Aspire","title":"Aspire","menuText":""}}
{"pr":"17793","phase":"pr","active":{"aria":"Aspire","title":"Aspire","menuText":"Collapse child resources Show resource types Show hidden resources"}}

One thing I'm not fully convinced on: focus still lands on the Aspire logo in this View options path. The popup disappearing part is fixed, but if the intended behavior is also to avoid resetting focus to the first interactive control, this may still need another tweak.

[github-actions]

Re-running the failed jobs in the CI workflow for this pull request because 2 jobs were identified as retry-safe transient failures in the CI run attempt.
GitHub was asked to rerun all failed jobs for that attempt, and the rerun is being tracked in the rerun attempt.
The job links below point to the failed attempt jobs that matched the retry-safe transient failure rules.

• Tests / Cli.EndToEnd-ChannelUpdateWorkflowTests / Cli.EndToEnd-ChannelUpdateWorkflowTests (ubuntu-latest) - Test execution failure will be retried because 1 failed test(s) matched transient test failure patterns (Unable to access container registry during publish).
• Tests / Cli.EndToEnd-KubernetesDeployWithRedisTests / Cli.EndToEnd-KubernetesDeployWithRedisTests (ubuntu-latest) - Test execution failure will be retried because 1 failed test(s) matched transient test failure patterns (Unable to access container registry during publish).

Matched test failure patterns (1 test)

• Aspire.Cli.EndToEnd.Tests.KubernetesDeployWithRedisTests.DeployK8sWithRedis — Unable to access container registry during publish

[Adam Ratzman (adamint)]

Updated browser verification after the latest fix.

Steps I used:

1. Opened the dashboard Resources page in the mock dashboard host with TestResource.
2. Clicked View options.
3. Pressed Tab twice.

Main branch behavior: after those two Tabs, the popup is dismissed and focus resets to Aspire.

This PR behavior: after those two Tabs, the popup is dismissed and focus moves predictably to Resources, which is the next logical control after the View options trigger. That matches the issue expectation: focus no longer falls back to the first interactive control on the page.

Proof:

• MP4 recording, with visible keyboard/mouse/focus trace overlay: https://raw.githubusercontent.com/adamint/aspire/cd33e79ec249a7354240cc851b921502ada33d1a/proof/a11y/17793/pr-17793-visual-proof.mp4
• Contact sheet: https://raw.githubusercontent.com/adamint/aspire/cd33e79ec249a7354240cc851b921502ada33d1a/proof/a11y/17793/pr-17793-contact-sheet.png

Before:

After:

[Adam Ratzman (adamint)]

Condensed into #17926 to keep the related Resources a11y changes together. Closing this smaller draft.