feat(jira): sync the full Purple Team workflow status to Jira

Previously only red_executing (-> "In Progress") ever changed the Jira
issue's status; every other Aegis transition (red_review, blue_evaluating,
blue_review, in_review, validated, rejected, disputed) only posted a
comment, leaving the Jira board stuck on whatever status it started with.

Expands push_test_event() to a full TestState -> Jira-status table
covering the whole lifecycle (To-Do -> In Progress -> RT Test Review ->
Queued Blue Team -> In Progress -> Blue Team Test Review -> Validation ->
Done/Rejected/Dispute), matching the Purple Team Jira workflow. Adds two
new lifecycle hooks that the generic dispatch can't handle correctly:

- push_bt_work_started(): blue_evaluating covers both "queued, unclaimed"
  and "actively being worked" — needs an explicit push when the blue tech
  clicks Start Evaluation, or it never leaves "Queued Blue Team".
- disputed state push: a conflicting lead vote previously produced zero
  Jira signal at all.

Also fills two real gaps: reopen_red_review and reopen_blue_review never
synced anything to Jira before. Their target status differs on purpose —
reopen_red_review pushes "In Progress" (Aegis resumes the same operator
immediately, no re-claim), while reopen_blue_review pushes "Queued Blue
Team" (Aegis clears blue_work_started_at, forcing a fresh "Start
Evaluation" click) — verified against the actual field-reset behavior in
test_entity.py rather than assumed symmetry between the two teams.

backend/tests/test_jira_service.py

@@ -56,6 +56,15 @@ def _make_test(**overrides):
     t.execution_end_time = None
     t.detection_time = None
     t.containment_time = None
+    # _build_state_comment() appends these raw (not via an f-string) when
+    # truthy, so an un-nulled MagicMock attribute breaks "\n".join(lines).
+    t.red_summary = None
+    t.blue_summary = None
+    t.remediation_steps = None
+    t.red_validation_status = None
+    t.blue_validation_status = None
+    t.red_validation_notes = None
+    t.blue_validation_notes = None
     for k, v in overrides.items():
         setattr(t, k, v)
     return t
@@ -107,6 +116,58 @@ def test_push_hold_event_sets_blocked(mock_get_client, mock_configured, db):
     mock_jira.set_issue_status.assert_called_once_with(link.jira_issue_key, "Blocked")
 
 
+@pytest.mark.parametrize(
+    "new_state,expected_status",
+    [
+        ("draft", "To-Do"),
+        ("red_executing", "In Progress"),
+        ("red_review", "RT Test Review"),
+        ("blue_evaluating", "Queued Blue Team"),
+        ("blue_review", "Blue Team Test Review"),
+        ("in_review", "Validation"),
+        ("validated", "Done"),
+        ("rejected", "Rejected"),
+        ("disputed", "Dispute"),
+    ],
+)
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_test_event_maps_every_state_to_jira_status(
+    mock_get_client, mock_configured, db, new_state, expected_status
+):
+    """Every TestState the Purple Team Jira workflow needs to reflect must
+    have a corresponding status transition — not just red_executing."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test()
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_test_event(db, test, MagicMock(username="alice", jira_account_id=None), new_state)
+
+    mock_jira.set_issue_status.assert_called_once_with(link.jira_issue_key, expected_status)
+
+
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_bt_work_started_sets_in_progress(mock_get_client, mock_configured, db):
+    """blue_evaluating covers both 'queued, unclaimed' and 'actively being
+    worked' — the state alone can't distinguish them, so start_blue_work
+    must explicitly push In Progress rather than relying on the generic
+    state->status dispatch (which would incorrectly re-push Queued Blue Team)."""
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test()
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_bt_work_started(db, test, MagicMock(username="bob"))
+
+    mock_jira.set_issue_status.assert_called_once_with(link.jira_issue_key, "In Progress")
+
+
 @patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
 @patch("app.services.jira_service.get_admin_jira_client")
 def test_push_rt_started_sets_date_field(mock_get_client, mock_configured, db):