fix(tests): pause reopen timer, lock edits to assignee, restore Jira operator on reopen

- reopen_red_review starts the timer paused (paused_at set) instead of
  immediately running, since the operator hasn't resumed working yet —
  blue already did this via blue_work_started_at, red needed the same
  behavior via the existing pause/resume mechanism.
- update_test_red/update_test_blue now lock edits to the actual assigned
  operator for leads too, not just techs — a lead could previously edit
  another operator's in-progress test. Mirrored in TeamTabs.tsx.
- push_test_event reassigns the Jira ticket to the original operator
  (not the reopening lead) when a test returns to red_executing or
  blue_evaluating for rework, instead of leaving it on the lead.

backend/tests/test_jira_service.py

@@ -65,6 +65,8 @@ def _make_test(**overrides):
     t.blue_validation_status = None
     t.red_validation_notes = None
     t.blue_validation_notes = None
+    t.red_tech_assignee = None
+    t.blue_tech_assignee = None
     for k, v in overrides.items():
         setattr(t, k, v)
     return t
@@ -149,14 +151,12 @@ def test_push_test_event_maps_every_state_to_jira_status(
     mock_jira.set_issue_status.assert_called_once_with(link.jira_issue_key, expected_status)
 
 
-@pytest.mark.parametrize("new_state", ["blue_evaluating", "in_review"])
 @patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
 @patch("app.services.jira_service.get_admin_jira_client")
-def test_push_test_event_clears_assignee_on_handoff(mock_get_client, mock_configured, db, new_state):
+def test_push_test_event_clears_assignee_on_in_review(mock_get_client, mock_configured, db):
     """Regression: the previous reviewer's assignment must not linger on the
-    ticket after a hand-off to a different team / dual-validation stage —
-    e.g. approving red_review left the red_lead reviewer stuck as assignee
-    all through blue_evaluating."""
+    ticket once dual-validation starts — both leads act independently, so
+    there's no single owner."""
     mock_jira = MagicMock()
     mock_get_client.return_value = mock_jira
     test = _make_test()
@@ -164,11 +164,100 @@ def test_push_test_event_clears_assignee_on_handoff(mock_get_client, mock_config
     db.add(link)
     db.commit()
 
-    jira_service.push_test_event(db, test, MagicMock(username="alice", jira_account_id=None), new_state)
+    jira_service.push_test_event(db, test, MagicMock(username="alice", jira_account_id=None), "in_review")
 
     mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id=None)
 
 
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_test_event_clears_assignee_on_fresh_blue_queue_entry(mock_get_client, mock_configured, db):
+    """A test reaching blue_evaluating for the first time (red just approved)
+    has no blue_tech_assignee yet — queued, no owner, must not stay stuck on
+    the red_lead who approved it."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test()  # blue_tech_assignee defaults to None
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_test_event(db, test, MagicMock(username="alice", jira_account_id=None), "blue_evaluating")
+
+    mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id=None)
+
+
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_test_event_reassigns_blue_operator_on_reopen(mock_get_client, mock_configured, db):
+    """Regression: reopening blue_review (rework) sends the test back to
+    blue_evaluating, but the SAME operator is still assigned in Aegis
+    (blue_tech_assignee isn't cleared, only blue_work_started_at is) — Jira
+    must give them the ticket back, not leave it on the blue_lead who
+    reopened it or clear it as if nobody owned it."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    from app.models.user import User
+    blue_tech = User(
+        username="bluetech-reopen", email="bluetech-reopen@test.com",
+        hashed_password="x", role="blue_tech", jira_account_id="blue-tech-account",
+    )
+    db.add(blue_tech)
+    db.commit()
+    test = _make_test(blue_tech_assignee=blue_tech.id)
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_test_event(
+        db, test, MagicMock(username="bluelead", jira_account_id=None), "blue_evaluating",
+    )
+
+    mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id="blue-tech-account")
+
+
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_test_event_red_executing_assigns_actor_by_default(mock_get_client, mock_configured, db):
+    """The normal start-execution path: no explicit assignee param, so the
+    acting operator (actor) is who gets the ticket."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test()
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_test_event(
+        db, test, MagicMock(username="redtech", jira_account_id="red-tech-account"), "red_executing",
+    )
+
+    mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id="red-tech-account")
+
+
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_test_event_red_executing_reassigns_original_operator_on_reopen(mock_get_client, mock_configured, db):
+    """Regression: reopening red_review sends the test back to
+    red_executing, but *actor* here is the red_lead who reopened it, not
+    the operator who should keep working it. The caller passes the
+    original operator as the explicit assignee, which must win over actor."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test()
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+    original_operator = MagicMock(username="redtech", jira_account_id="red-tech-account")
+    reopening_lead = MagicMock(username="redlead", jira_account_id="red-lead-account")
+
+    jira_service.push_test_event(
+        db, test, reopening_lead, "red_executing", assignee=original_operator,
+    )
+
+    mock_jira.assign_issue.assert_called_once_with(link.jira_issue_key, account_id="red-tech-account")
+
+
 @patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
 @patch("app.services.jira_service.get_admin_jira_client")
 def test_push_bt_work_started_sets_in_progress(mock_get_client, mock_configured, db):