feat(jira): push Attack Contained field (customfield_11885) on BT submit

Maps Test.containment_result (contained/partially_contained/not_contained)
to Yes/Partial/No, mirroring the existing Attack Success/Attack Detected
field push in push_bt_submitted. Field ID was the last missing piece
blocking this from Block 4.

backend/app/services/jira_service.py

@@ -80,6 +80,7 @@ JIRA_FIELD_ATTACK_DETECTED = "customfield_11809"
 JIRA_FIELD_TIME_TO_DETECT = "customfield_11810"
 JIRA_FIELD_TIME_TO_CONTAIN = "customfield_11811"
 JIRA_FIELD_DATA_SENSITIVITY = "customfield_11233"
+JIRA_FIELD_ATTACK_CONTAINED = "customfield_11885"
 
 _ATTACK_SUCCESS_TO_JIRA = {
     "successful": "Yes",
@@ -93,6 +94,12 @@ _DETECTION_TO_JIRA = {
     "partially_detected": "Partial",
 }
 
+_CONTAINMENT_TO_JIRA = {
+    "contained": "Yes",
+    "not_contained": "No",
+    "partially_contained": "Partial",
+}
+
 _DATA_CLASSIFICATION_TO_JIRA = {
     "public_release": "Public Release",
     "general_use": "General Use",
@@ -995,13 +1002,17 @@ def push_bt_started(db: Session, test: Test) -> None:
 
 
 def push_bt_submitted(db: Session, test: Test) -> None:
-    """Set BT End Date, Attack Detected, and time-to-detect/contain — Blue submits for review."""
+    """Set BT End Date, Attack Detected/Contained, and time-to-detect/contain — Blue submits for review."""
     fields: dict = {JIRA_FIELD_BT_END_DATE: datetime.utcnow().strftime("%Y-%m-%d")}
 
     detection_result = _enum_value(test.detection_result)
     if detection_result in _DETECTION_TO_JIRA:
         fields[JIRA_FIELD_ATTACK_DETECTED] = _DETECTION_TO_JIRA[detection_result]
 
+    containment_result = _enum_value(test.containment_result)
+    if containment_result in _CONTAINMENT_TO_JIRA:
+        fields[JIRA_FIELD_ATTACK_CONTAINED] = _CONTAINMENT_TO_JIRA[containment_result]
+
     time_to_detect = _compute_hours(test.execution_end_time, test.detection_time)
     if time_to_detect is not None:
         fields[JIRA_FIELD_TIME_TO_DETECT] = time_to_detect

backend/tests/test_jira_service.py

@@ -52,6 +52,7 @@ def _make_test(**overrides):
     t.name = "Test"
     t.attack_success = None
     t.detection_result = None
+    t.containment_result = None
     t.execution_end_time = None
     t.detection_time = None
     t.containment_time = None
@@ -167,6 +168,22 @@ def test_push_bt_submitted_includes_detection_and_hours(mock_get_client, mock_co
     assert fields[jira_service.JIRA_FIELD_TIME_TO_CONTAIN] == 1.5
 
 
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_bt_submitted_includes_attack_contained(mock_get_client, mock_configured, db):
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test(containment_result=MagicMock(value="partially_contained"))
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_bt_submitted(db, test)
+
+    fields = mock_jira.update_issue_field.call_args[1]["fields"]
+    assert fields[jira_service.JIRA_FIELD_ATTACK_CONTAINED] == "Partial"
+
+
 def test_update_test_fields_noop_when_not_configured(db):
     test = _make_test()
     # has_admin_jira_configured defaults to False without mocking — should