"Part 6 6.2.3 Certificate Chains" describes that certificate chains can be used for

• SecureChannel negotiation
• CreateSession/ActivateSession handshake.

I recommend to state also the EndpointDescriptions for the GetEndpoints service as this is the usual way to get a yet unknown certificate.
If a GetEndpoints service returns only the leaf certificate then it is likely that the client cannot validate the server certificate before trying to open the SecureChannel, thus the procedure to create a new connection is likely to fail due to unexpected reasons.

Chains are already implicitly allowed for the EndpointDescriptions as in "All OPC UA applications shall accept partial or complete chains in any field that contains a DER encoded Certificate", but I would state the GetEndpointsService explicitly, similar as for SecureChannel, CreateSession and ActivateSession.