fix(tests): restrict on-hold to techs and admin, remove leads

backend/app/routers/tests.py

@@ -1131,7 +1131,7 @@ def hold_test(
     test_id: uuid.UUID,
     payload: TestHold,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "red_lead", "blue_lead", "admin")),
+    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "admin")),
 ):
     """Place a test on hold with a mandatory reason. Posts comment + transitions Jira."""
     from datetime import datetime as _dt
@@ -1171,7 +1171,7 @@ def hold_test(
 def resume_test(
     test_id: uuid.UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "red_lead", "blue_lead", "admin")),
+    current_user: User = Depends(require_any_role("red_tech", "blue_tech", "admin")),
 ):
     """Resume a test that was placed on hold."""
     from app.services.jira_service import push_hold_event

frontend/src/components/test-detail/TestDetailHeader.tsx

@@ -127,7 +127,7 @@ export default function TestDetailHeader({
   const HOLDABLE_STATES: TestState[] = ["draft", "red_executing", "blue_evaluating"];
   const canHold =
     HOLDABLE_STATES.includes(test.state) &&
-    (role === "red_tech" || role === "blue_tech" || role === "red_lead" || role === "blue_lead" || role === "admin");
+    (role === "red_tech" || role === "blue_tech" || role === "admin");
 
   const renderActions = () => {
     const buttons: React.ReactNode[] = [];