Bash script or Jamf Policy to move Wi-FI to top of Network Services list

This is pretty easy to do.

Network Preferences has a whole command-line suite available for confirming the network, with a high degree of control.

In this case, you want to use networksetup with the -ordernetworkservices switch:

networksetup -ordernetworkservices "WiFi" "Built-in Ethernet 1" "USB 10/100/100 LAN"

The above would configure the system to prefer WiFi, then the built-in ethernet, then a USB adapter.

You can get a list of available devices on the current system via:

networksetup --listallnetworkservices

and you can review the current priority order via:

networksetup -listnetworkserviceorder

Ultimately, the -listallnetworkservices and -listnetworkserviceorder switches are going to be the key.

However, you're going to have to work out some rule for identifying the WiFi network adapter if users have unfettered access to naming their devices.

Looking at the -listallnetworkservices output, there is an indicator as to the interface type there:

(4) Wi-Fi
(Hardware Port: Wi-Fi, Device: en0)

so you could parse the 'Hardware Port: Wi-Fi' string to identify the network.

Alternatively, a couple of things come to mind.

First, I think you only need to specify the WiFi network in the -ordernetworkservices command - whatever you specify comes to the top, with the remaining interfaces listed afterwards.

As for identifying the WiFi network, you could trial-and-error using the networksetup -getairportnetwork command, which will indicate if the network is a Wi-Fi or wired connection:

networksetup -getairportnetwork en1
en1 is not a Wi-Fi interface.
networksetup -getairportnetwork en2
Current Wi-Fi Network: MyAirPortNetwork

This would help you identify the hardware port that is your wifi network, which can then track to the service name.

Alternatively the -listnetworkserviceorder indicates the Hardware Port, which you can parse out via grep:

networksetup -listnetworkserviceorder | grep -B1 "Hardware Port: Wi-Fi"
(4) Wi-Fi
(Hardware Port: Wi-Fi, Device: en0)

So now you know the service name (just need to nix the '(4) ' from the first line).

Ultimately, these are the kind of games you're going to have to play to get a universal solution that works on all systems.

If that's too much logic processing in shell scripts (which I have a hard time with, personally), the commands can be invoked via a number of different systems, I'm not familiar enough with Jamf to know what other options it has, though.