[Phase 4] Saved recipes: reusable non-destructive batch pipelines #11

Priority: P3
Parent roadmap: #1
Dependencies: #4 job framework; ideally #10 custom action registry and #5 history.

User story

Select 20 images in Finder → run a saved Export for Web recipe: resize longest edge to 1600 px → convert to WebP/PNG/JPEG as configured → strip GPS metadata → publish copies into an export folder. No need to repeat several dialogs.

Requirements

• Recipe editor for ordered typed steps, starting with Tuck's existing built-in image/PDF/file operations (do not require arbitrary scripting).
• Preview readable step order, accepted input types, expected files, output naming and conflicts; explicit final confirmation for move/rename/trash steps.
• Clear input/output mapping so each step processes the prior step's outputs, with temp work files kept distinct from final published files.
• Per-step failures, cancellation, bounded concurrency and retry; maintain an audit trail of what was produced and why.
• Atomic or staged publication where feasible: only mark final results successful after verification; original files remain untouched by default.
• User-facing recipes stored in versioned, inspectable format with import/export that cannot silently execute commands.
• Optional custom actions only through the separately consented mechanism from [Phase 4] Safe custom Finder actions, macOS Shortcuts, and keyboard access #10.

Acceptance criteria

• Can save, edit, reorder, duplicate, run and delete recipes.
• Type incompatibilities and unsupported codecs are reported before a job starts when detectable.
• Safe collision handling and rollback/cleanup; no unintended reruns of non-idempotent steps.
• Reusable recipes run from contextual Finder menu, optionally by keyboard shortcut.
• No implicit cloud/AI processing and no quality presets added to strict-cap compression.

Verification

Integration tests for multi-image export, mixed format errors, name collisions, failure mid-pipeline, external unmount, cancellation and interrupted process recovery. Memory and scratch use remain bounded.