percona-obs: never promote on content-check service failure; compare rendered referenced macros

[rjd15372]

Summary

Two fixes to the sync push --branch-from decision, found while analysing the OBS PR Check failure on PR #12 (run 32974781249): an unrelated, unchanged package (ppg:staging:17:extras/percona-postgresql) was promoted, then the upload phase failed for real on a git.postgresql.org clone reset.

1. A transient service failure during the content check promoted the package. _content_matches_branch caught the SystemExit from a failed local service run and returned "content differs". A failed run says nothing about the content, so it is now retried once and a second failure aborts the whole sync with the service's error (queued Phase 1 decisions are cancelled so the error surfaces immediately).
2. ~120 staging packages were needlessly in the content-check fallback on every PR run. _macros_changed_since compared inherited macros.yaml at file level (git diff --name-only <sha>..HEAD). Commit 146694c moved macros between staging/17/extras, staging/17 and staging/macros.yaml with identical rendered values, which flagged every ppg/staging package as "inherited macros changed" against the (still valid, legacy-repo) production sync SHAs. The check now compares the rendered values of the %!{NAME} macros the package actually references between the synced SHA (git show) and the working tree, so moving a macro, or bumping one the package never uses, is not a change.

Changes

• percona_obs/cmd_sync.py — _run_services_for_check (retry once, then SystemExit); Phase 1 executor cancels queued futures on error; _clean_sync_check reason renamed to referenced macros changed.
• percona_obs/git_utils.py — _macros_changed_since rewritten: _referenced_macros (scan of UTF-8 files under the package dir minus the FILE_MODIFY_DATE* builtins), _commit_exists, memoised _git_show_at, comparison via resolve_macros/load_macros. Signature unchanged, so sync_state.manifest_entry_clean (--skip-unchanged manifest) gets the same fix.
• percona_obs/common.py — load_macros split into _macros_chain_files + resolve_macros(sources) so the historical tree resolves through the same parser.
• Docs: .github/copilot-instructions.md (branch decision section, verbose-output table), docs/PERCONA_OBS_TOOL.md.

Verification

• pytest: 124 passed (11 new — tests/test_content_check_retry.py incl. an end-to-end _resolve_branch_decision case; tests/test_macros_changed_since.py on a real temporary git repo, no git mocking). black + pyright clean.
• Against the legacy production SHA 6440e48 on real history: the old check flagged 315/315 ppg/staging packages; the new check flags 4, all genuine version bumps since that SHA (percona-pg_tde ×3, 19/percona-haproxy).

Notes

• Deliberately not addressed: refreshing the legacy sync: main@… (rjd15372/percona-obs-packaging) revision comments (unneeded — the SHAs resolve and now compare clean), and the empty obs_scm actions/cache on PR runners (CI workflow, separate).
• No packaging content changes, so the PR OBS check should have nothing to promote.