fix(caller-drift): skip a remediation write whose content is already the canon

[LukasWodka]

Bugbot on the staging promotion PR #238. Fixed on develop so the train re-prepares, not pushed onto the promotion PR.

The bug

remediate_copies read each copy's blob sha and then always PUT, never comparing what the branch already carried against the canonical bytes.

So a second --create-prs dispatch re-writes identical content. The API answers 409 (or loses a sha race), remediation records a failure, and the org audit goes red as if the fleet could not be written — while the open PR already carries the canon. The run reports a fleet-wide write failure that never happened.

standards-sync.py already does the right thing:

ifcurrentisnotNoneandcurrent==desired:
return_ensure_pr(full, head, base, issue) # content already pushed; just ensure the PR

That skip is what makes its 422 branch reuse genuinely idempotent. This is the same fix in the same shape.

What changed

• _read_copy_on_head returns (sha, decoded bytes, error) instead of just the sha, so the caller can distinguish an already-correct copy from a drifted one. Same signature shape as standards-sync's _read_head_file, and for the same reason.
• The loop skips the PUT when the branch content equals the canon, and still falls through to _ensure_copy_pr — otherwise the first run's work would never become reviewable.
• import binascii, because a malformed blob now decodes here and b64decode raises binascii.Error, not ValueError alone. Without it the error path would NameError exactly when it was needed.

The selftest was modelling the old call shape

Both remediation stubs returned a bare "existingsha\n" — correct for the old --jq .sha call, but not what the API sends. That is why this skip was untestable: there was no content to compare.

The stubs now return {sha, content} with the branch's current body as a parameter, so a test can say what the branch already carries. New cases:

• a copy already matching the canon is not re-written
• the PR is still ensured when every write was skipped

Test plan

• python3 scripts/tests/caller-drift-selftest.py → 162 pass / 0 fail (was 160)
• ruff check --isolated --select E4,E7,E9,F → clean
• Negative test: removing the skip fails remediation: a copy already matching the canon is not re-written

---

Note

Low Risk
Scoped to copy remediation in caller-drift.py with expanded selftests; behavior change is skipping no-op writes, reducing API failure risk on re-dispatch.

Overview
Fixes false remediation failures on a second --create-prs dispatch: remediate_copies used to read only the blob sha and always PUT, so re-running against a branch that already had the canonical workflow triggered 409/sha races and marked the fleet as unwritable even when the open PR was already correct.

_read_copy_on_head now returns (sha, decoded bytes, error) from the full Contents API (aligned with standards-sync.py), with binascii handling bad base64 on the error path.

remediate_copiesskips the PUT when decoded branch content equals the canonical bytes and still calls _ensure_copy_pr so the PR remains open/reviewable.

Selftest stubs return real {sha, content} payloads and add cases for no re-write when content matches and PR ensured when all writes are skipped.

^{Reviewed by Cursor Bugbot for commit 4b91242. Bugbot is set up for automated code reviews on this repo. Configure here.}