feat(jira): sync the full Purple Team workflow status to Jira

Previously only red_executing (-> "In Progress") ever changed the Jira
issue's status; every other Aegis transition (red_review, blue_evaluating,
blue_review, in_review, validated, rejected, disputed) only posted a
comment, leaving the Jira board stuck on whatever status it started with.

Expands push_test_event() to a full TestState -> Jira-status table
covering the whole lifecycle (To-Do -> In Progress -> RT Test Review ->
Queued Blue Team -> In Progress -> Blue Team Test Review -> Validation ->
Done/Rejected/Dispute), matching the Purple Team Jira workflow. Adds two
new lifecycle hooks that the generic dispatch can't handle correctly:

- push_bt_work_started(): blue_evaluating covers both "queued, unclaimed"
  and "actively being worked" — needs an explicit push when the blue tech
  clicks Start Evaluation, or it never leaves "Queued Blue Team".
- disputed state push: a conflicting lead vote previously produced zero
  Jira signal at all.

Also fills two real gaps: reopen_red_review and reopen_blue_review never
synced anything to Jira before. Their target status differs on purpose —
reopen_red_review pushes "In Progress" (Aegis resumes the same operator
immediately, no re-claim), while reopen_blue_review pushes "Queued Blue
Team" (Aegis clears blue_work_started_at, forcing a fresh "Start
Evaluation" click) — verified against the actual field-reset behavior in
test_entity.py rather than assumed symmetry between the two teams.

backend/tests/test_workflow.py

@@ -690,6 +690,79 @@ class TestReviewDecisions:
         assert result.state == TestState.in_review
         assert result.system_gaps == "Missing EDR agent on host X"
 
+    @patch("app.services.jira_service.push_test_event")
+    @patch("app.services.test_workflow_service.log_action")
+    def test_reopen_red_review_pushes_in_progress_to_jira(self, mock_log, mock_push):
+        """Sent back for RT rework resumes the same operator immediately —
+        must push 'In Progress', not require a fresh queue/re-claim."""
+        test = _make_test(TestState.red_review, red_tech_assignee=uuid.uuid4())
+        reviewer = _make_user("red_lead")
+        db = _make_db()
+
+        from app.services.test_workflow_service import reopen_red_review
+        reopen_red_review(db, test, reviewer, notes="add more detail")
+
+        mock_push.assert_called_once()
+        args, kwargs = mock_push.call_args
+        assert args[3] == "red_executing"
+
+    @patch("app.services.jira_service.push_test_event")
+    @patch("app.services.test_workflow_service.log_action")
+    def test_reopen_blue_review_pushes_blue_evaluating_to_jira(self, mock_log, mock_push):
+        """Sent back for BT rework clears blue_work_started_at (the operator
+        must re-claim via 'Start Evaluation') — must push 'Queued Blue Team',
+        the same status a first-time entry gets."""
+        test = _make_test(TestState.blue_review, blue_tech_assignee=uuid.uuid4())
+        reviewer = _make_user("blue_lead")
+        db = _make_db()
+
+        from app.services.test_workflow_service import reopen_blue_review
+        reopen_blue_review(db, test, reviewer, notes="redo it")
+
+        mock_push.assert_called_once()
+        args, kwargs = mock_push.call_args
+        assert args[3] == "blue_evaluating"
+
+
+class TestStartBlueWork:
+    @patch("app.services.jira_service.push_bt_work_started")
+    @patch("app.services.jira_service.push_bt_started")
+    @patch("app.services.test_workflow_service.log_action")
+    def test_start_blue_work_pushes_in_progress(self, mock_log, mock_push_started, mock_push_work_started):
+        test = _make_test(TestState.blue_evaluating)
+        test.blue_work_started_at = None
+        blue_tech = _make_user("blue_tech")
+        db = _make_db()
+
+        from app.services.test_workflow_service import start_blue_work
+        result = start_blue_work(db, test, blue_tech)
+
+        assert result.blue_work_started_at is not None
+        mock_push_work_started.assert_called_once()
+
+
+class TestDisputedJiraSync:
+    @patch("app.services.jira_service.push_test_event")
+    @patch("app.services.test_workflow_service.log_action")
+    def test_dual_validation_disputed_pushes_dispute_status(self, mock_log, mock_push):
+        """A conflicting vote (one lead approved, the other rejected) must
+        surface as a distinct 'Dispute' status in Jira — previously this
+        transition posted no Jira signal at all."""
+        test = _make_test(
+            TestState.in_review,
+            red_validation_status="approved",
+        )
+        blue_lead = _make_user("blue_lead")
+        db = _make_db()
+
+        from app.services.test_workflow_service import validate_as_blue_lead
+        result = validate_as_blue_lead(db, test, blue_lead, "rejected", notes="Not detected")
+
+        assert result.state == TestState.disputed
+        mock_push.assert_called_once()
+        args, kwargs = mock_push.call_args
+        assert args[3] == "disputed"
+
 
 # ===========================================================================
 # 12c. resolve_dispute — flip approver's vote to reject, route to a team