ci: fix review findings - heredoc, state validation, lazy import wording

Fix heredoc with indented EOF terminator that never terminates - replace
with printf. Run state validation on all outcomes (not just success) so
corrupted state from a failed audit is caught before caching. Only stamp
last_run when audit succeeds. Align test-health lazy import section with
its own Constraints (report count only, don't duplicate structure audit).

Also fixes datetime.utcnow() deprecation and shell variable injection
in Python string by using os.environ instead.

Author: andreatgretel

.agents/recipes/test-health/recipe.md

@@ -107,9 +107,9 @@ grep -rn "^import pandas\|^from pandas\|^import numpy\|^from numpy\|^import duck
   packages/*/src/ --include='*.py'
 ```
 
-These should use `data_designer.lazy_heavy_imports`. Cross-reference with
-the structure recipe's findings if available in runner memory, but don't
-skip this check - it directly affects user experience.
+These should use `data_designer.lazy_heavy_imports`. Report the count of
+violations found, then refer to Wednesday's structure audit for the full
+breakdown. Do not duplicate the detailed analysis here.
 
 ### 4. Executable smoke checks
 

.github/workflows/agentic-ci-daily.yml

@@ -103,14 +103,8 @@ jobs:
         run: |
           mkdir -p .agentic-ci-state
           if [ ! -f .agentic-ci-state/runner-state.json ]; then
-            cat > .agentic-ci-state/runner-state.json <<EOF
-          {
-            "suite": "${SUITE}",
-            "last_run": null,
-            "known_issues": [],
-            "baselines": {}
-          }
-          EOF
+            printf '{"suite":"%s","last_run":null,"known_issues":[],"baselines":{}}\n' \
+              "${SUITE}" > .agentic-ci-state/runner-state.json
           fi
           echo "Runner memory state:"
           cat .agentic-ci-state/runner-state.json
@@ -189,21 +183,24 @@ jobs:
             2>&1 | tee /tmp/claude-audit-log.txt
 
       - name: Update runner memory
-        if: steps.audit.outcome == 'success'
+        if: always()
         env:
           SUITE: ${{ matrix.suite }}
+          AUDIT_OUTCOME: ${{ steps.audit.outcome }}
         run: |
-          # Validate the agent didn't corrupt the state file
+          # Always validate state (cache saves regardless of outcome)
           python3 -c "
-          import json, datetime, sys
+          import json, datetime, os
           try:
               with open('.agentic-ci-state/runner-state.json') as f:
                   state = json.load(f)
           except (json.JSONDecodeError, FileNotFoundError) as e:
               print(f'::warning::runner-state.json is invalid ({e}), resetting')
-              state = {'suite': '${SUITE}', 'known_issues': [], 'baselines': {}}
-          state['last_run'] = datetime.datetime.utcnow().isoformat() + 'Z'
-          state['suite'] = '${SUITE}'
+              state = {'suite': os.environ['SUITE'], 'known_issues': [], 'baselines': {}}
+          # Only stamp last_run if the audit actually succeeded
+          if os.environ.get('AUDIT_OUTCOME') == 'success':
+              state['last_run'] = datetime.datetime.now(datetime.timezone.utc).isoformat()
+          state['suite'] = os.environ['SUITE']
           with open('.agentic-ci-state/runner-state.json', 'w') as f:
               json.dump(state, f, indent=2)
           "