CLI: implement `bgagent jira invite-user` — issuing half of Jira identity linking

[ayushtr-aws]

Component

Scripts / CLI

Describe the feature

Implement bgagent jira invite-user — the missing issuing half of the Jira identity-linking handshake.

The redeeming half already exists and works end-to-end: bgagent jira link <code> → POST /v1/jira/link → cdk/src/handlers/jira-link.ts consumes a one-time code and writes the user-mapping row. But nothing can mint a code today:

• bgagent jira setup's "Next steps" output says: "(an admin runs bgagent jira invite-user to issue you a code; this command is not yet implemented — populate the user-mapping row manually for now.)" (cli/src/commands/jira.ts:579)
• JIRA_SETUP_GUIDE.md Step 5 carries the same caveat.
• When an unlinked Jira user adds the trigger label, the webhook processor comments back on the issue: "Run bgagent jira link <code>" (cdk/src/handlers/jira-webhook-processor.ts:~330) — a dead end, since no code can be issued.

The only workaround is an admin hand-writing the DynamoDB row (jira_identity = <cloudId>#<accountId>, platform_user_id, jira_cloud_id, jira_account_id), which requires reading handler source to discover the schema.

Linear already has the exact analog implemented: bgagent linear invite-user <slug> (cli/src/commands/linear.ts:1171) writes a pending#<code> row with a 24 h TTL to the user-mapping table; the teammate redeems it with linear link <code>. Jira has the redemption path but not the issuance path — this is a Linear-parity gap left over from #288/#302.

Use case

An admin onboarding teammates to the Jira integration currently has to hand-craft DynamoDB rows per user, reverse-engineered from handler source. Every unlinked user who triggers a label also receives a bot comment instructing them to run a command that cannot succeed. With invite-user, the flow matches Linear: admin runs one command, sends the code, teammate redeems it and sees their Jira name/email before confirming.

Proposed solution

Port linear invite-user (cli/src/commands/linear.ts:1171-…) to cli/src/commands/jira.ts:

• bgagent jira invite-user <cloud-id> <account-id-or-email> (admin IAM): resolve the teammate's Jira identity via the tenant OAuth token (/rest/api/3/user/search), write a pending#<code> row to JiraUserMappingTable (24 h TTL, mirroring Linear's shape and jira-link.ts's expectations), print the one-time code.
• Teammate redeems with the existing bgagent jira link <code> (already implemented, shows name+email preview before binding).
• Update JIRA_SETUP_GUIDE.md Step 5 and the setup "Next steps" text to drop the "not yet implemented" caveats.

Other information

Identity-linking docs gap (the manual-row interim path) is tracked separately in #552.

Acknowledgements

• I may be able to implement this feature
• This might be a breaking change

[ayushtr-aws]

Starting implementation.