fix(tests): restrict On Hold/Resume to whichever team currently owns the test

canHold checked role OR role instead of matching the current phase, so
a red_tech still saw (and could call) Hold/Resume on a test already
sitting in blue_evaluating. Fixed on both frontend and backend — the
API had the same gap, not just the button visibility.

frontend/src/components/test-detail/TestDetailHeader.tsx

@@ -158,10 +158,13 @@ export default function TestDetailHeader({
 
   // ── Contextual action buttons ────────────────────────────────────
 
-  const HOLDABLE_STATES: TestState[] = ["draft", "red_executing", "blue_evaluating"];
+  // Whichever team currently "owns" the test is the only one who should see
+  // Hold — a red_tech shouldn't be able to hold a test that's already moved
+  // into blue_evaluating (and vice versa), even though both roles can hold
+  // during their own phase.
   const canHold =
-    HOLDABLE_STATES.includes(test.state) &&
-    (role === "red_tech" || role === "blue_tech");
+    (["draft", "red_executing"].includes(test.state) && role === "red_tech") ||
+    (test.state === "blue_evaluating" && role === "blue_tech");
 
   const renderActions = () => {
     const buttons: React.ReactNode[] = [];