The renderer remembered a failed render until the catalog revision moved,
and any op moved it: face results and metadata reads for other photos at
launch sent every undecodable file back to the decoder (issue #2682: 37
tries each in 154 s of idle). Renderer::follow_catalog asks the catalog
which photos changed (touched_since) and keeps a failure parked unless its
own photo is among them; when the catalog can't say, every failure is
retried as before. The failure record keeps its shape.
Test: render::thumbnail_tests::a_failed_thumbnail_is_retried_only_when_its_photo_changes
(fails on main at the "another photo's change retries nothing" check).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
