[Quality] Scale Finder IPC and selections while keeping menus instant #13

Priority: P1 (cross-cutting quality gate)
Parent roadmap: #1
Related: #3, #4, #10 and #11.

Motivation

Early Tuck authenticated tuck://perform requests limited selected paths to 16 and encoded file paths in a URL. Large selections and multiple new actions make that limit and menu responsiveness important. We must not silently truncate the user's selection or let Finder block on slow tasks.

Scope

• Inspect current selection capture and IPC limits, the exact live code rather than older reports. If a 16-path cap remains, replace silent truncation with a safe, scalable local handoff or explicit limit/error.
• Preserve the existing authenticated helper/extension boundary, request freshness/replay protection and path validation. Never use unsigned world-readable temp payloads.
• Avoid expensive metadata, codec probing, network work or filesystem recursion while Finder constructs a context menu.
• Make menu availability checks contextual but inexpensive; defer validation/execution until helper receives the request.
• Account for multi-volume sources, macOS sandbox access, Finder restarts, huge selections, Unicode and very long paths.
• Isolate heavy encoders and file operations behind jobs with bounded memory/parallelism. Prefer no long-lived heavy background component when idle.

Acceptance criteria

• A 1, 16, 17, 100 and 1,000 item selection either processes everything safely or explicitly explains a documented user-facing limit. Nothing disappears silently.
• A selection spanning directories/volumes and containing long/Unicode filenames is passed accurately.
• Invalid/malicious IPC requests are rejected; signatures/keys/full sensitive URLs aren't logged.
• Menu creation latency is measured on a representative directory (warm and cold), and the implementation documents a reasonable performance budget.
• Finder menu remains responsive even if external encoders, mounted volumes or the app helper are unavailable.
• No regression of menu enable/reorder settings or desktop/selection targeting.

Verification

Automated IPC boundary tests, fuzz/boundary payloads, benchmark selection-size scaling, physical Finder operations and constrained 8 GB RAM profiling. External scratch must be on a verified mounted volume and should fail closed rather than fall back internally.