feat(jira): push Attack Contained field (customfield_11885) on BT submit

Maps Test.containment_result (contained/partially_contained/not_contained)
to Yes/Partial/No, mirroring the existing Attack Success/Attack Detected
field push in push_bt_submitted. Field ID was the last missing piece
blocking this from Block 4.

backend/tests/test_jira_service.py

@@ -52,6 +52,7 @@ def _make_test(**overrides):
     t.name = "Test"
     t.attack_success = None
     t.detection_result = None
+    t.containment_result = None
     t.execution_end_time = None
     t.detection_time = None
     t.containment_time = None
@@ -167,6 +168,22 @@ def test_push_bt_submitted_includes_detection_and_hours(mock_get_client, mock_co
     assert fields[jira_service.JIRA_FIELD_TIME_TO_CONTAIN] == 1.5
 
 
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_push_bt_submitted_includes_attack_contained(mock_get_client, mock_configured, db):
+    mock_jira = MagicMock()
+    mock_get_client.return_value = mock_jira
+    test = _make_test(containment_result=MagicMock(value="partially_contained"))
+    link = _make_link(test.id)
+    db.add(link)
+    db.commit()
+
+    jira_service.push_bt_submitted(db, test)
+
+    fields = mock_jira.update_issue_field.call_args[1]["fields"]
+    assert fields[jira_service.JIRA_FIELD_ATTACK_CONTAINED] == "Partial"
+
+
 def test_update_test_fields_noop_when_not_configured(db):
     test = _make_test()
     # has_admin_jira_configured defaults to False without mocking — should