fix: annotate each comment-hygiene violation once per CI job

The build step runs build.ps1 and the test step runs test.ps1, so the gate ran
twice over the same tree and GitHub registered every violation twice. Verified
on a probe commit: two real violations produced four annotations. The first run
in a job now records a marker in GITHUB_ENV and later steps skip reporting.

Scoped to GitHub Actions on purpose. A marker in the process environment would
persist across runs in one interactive session, so an agent fixing a comment and
re-running would get a false pass on the second run. Local runs always scan.

The marker is appended with UTF8Encoding($false); a BOM part way through the
environment file would break the parse the runner does when the step ends.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: jasonleenaylor

Build/Agent/comment-hygiene.ps1

@@ -171,6 +171,21 @@ if ($Full) {
 	exit 0
 }
 
+# The build and test CI steps both invoke this gate over the same tree, which would
+# annotate every violation twice. The first run marks the job so the rest skip.
+if ($env:GITHUB_ACTIONS -eq 'true') {
+	if ($env:FW_COMMENT_HYGIENE_REPORTED -eq '1') {
+		Write-Host 'comment-hygiene: already reported earlier in this job.'
+		exit 0
+	}
+	if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
+		# UTF8Encoding($false): appending a BOM mid-file would corrupt the
+		# environment file the runner parses when the step ends.
+		[System.IO.File]::AppendAllText($env:GITHUB_ENV, "FW_COMMENT_HYGIENE_REPORTED=1`n",
+			(New-Object System.Text.UTF8Encoding($false)))
+	}
+}
+
 $base = Resolve-BaseRef -Explicit $BaseRef
 Write-Host "comment-hygiene: scanning lines added since $base"