fix: harden jira env handling in cascade-tools

[zbigniewsobiecki]

Summary

• accept CASCADE_JIRA_BASE_URL as the worker-injected JIRA base URL while preserving JIRA_BASE_URL as a legacy override
• inject both env names for JIRA-backed runs so mixed worker/CLI versions keep working during rollout
• improve the missing-JIRA-credentials error and fix the stale pushed-changes sidecar warning text
• add regression coverage for CLI credential scoping, secret injection, the clarified JIRA error, and the sidecar warning

Test Plan

• Unit tests pass (npm test)
• Linter passes (npm run lint)
• Type check passes (npm run typecheck)
• Tested manually (describe below)

Manual notes:

• Confirmed the focused regression suite for the new env-contract behavior before the full unit run.
• npm run test:integration remains blocked locally by Postgres authentication in the existing test environment (password authentication failed for user "postgres").

Checklist

• My code follows the project's code style
• I have added tests for new functionality
• I have updated documentation if needed
• My commits follow Conventional Commits

[codecov]

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/cli/base.ts	85.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!