Show the ES|QL path wherever the docs describe Discover steps in data view mode #9190

Goal

Wherever the docs describe Discover steps that assume a data view, show the {{esql}} path first when an equivalent exists, and keep the classic mode steps (data views, KQL, Lucene, and filters).

Discover opens in {{esql}} mode by default on serverless and in {{stack}} 9.6 and later. In {{stack}} 9.0 to 9.5, classic mode is still the default, and in every version readers can switch to it. So both paths stay accurate, and pages need to show both.

This work connects to two efforts on the Discover section: the rework of the Try ES|QL page into a tutorial and {{esql}} hub (#4890), and the restructure of the Discover docs (#4898).

This issue reaches beyond the Discover section. Tutorials, integration guides, deployment pages, and alerting pages across the docs tell readers to select a data view or filter with KQL in Discover.

Approach

• If the {{esql}} query is a simple equivalent, give it first and then the classic steps. Name each mode in its own sentence.
• If a step only works with a data view, or the {{esql}} path needs facts that aren't verified yet, keep a note that tells readers to switch to classic mode. Open an issue for the real update.
• Keep the classic mode content. Scope version-specific content with applies_to.

Status

PR #9017 already updated the pages where the {{esql}} path was a simple equivalent. This issue continues that work for the pages that look less simple or that need testing first. Some depend on facts that need verifying, such as index names or the fields in example data. Others are built around a data view and need a larger rewrite.

Each of those pages has its own issue, and they are sub-issues of this one.