fix: address review findings for #752 — regex and STATE.md cleanup

- Fix run_NNN scan regex: r'run(\d+)' → r'run_(\d+)' so it correctly
  matches the underscore-separated directory names the script creates
  (previously always resolved to 001, overwriting the same dir each run)
- Remove [in-progress] tag from STATE.md entry for #752

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tools/push3-evolution/evolve.sh

@@ -130,7 +130,7 @@ base = sys.argv[1]
 max_n = 0
 if os.path.isdir(base):
     for name in os.listdir(base):
-        m = re.fullmatch(r'run(\d+)', name)
+        m = re.fullmatch(r'run_(\d+)', name)
         if m and os.path.isdir(os.path.join(base, name)):
             max_n = max(max_n, int(m.group(1)))
 print(f"{max_n + 1:03d}")