[LeadcodeDev]

Refs #435 — first item. The second, publishing to crates.io, is outward-facing and
irreversible, so it stops at the boundary: see the end.

The default H.264 branch pushed -profile:v high10 -pix_fmt yuv420p10le with no
gate at all, so every render without --hardware-acceleration produced a High 10
file. QuickTime and Safari refuse those outright, and a user reported exactly
that: a file the tool had just written and they could not open.

The default is now -profile:v high -pix_fmt yuv420p. The old encode is still
reachable as --codec h264_10bit, the same libx264 call with the same crf and
preset.

Making it a codec name rather than a new flag means it travels plumbing that
already exists: codec: &str reaches ffmpeg_args from nine call sites, so
nothing needed a new parameter. Two lists had to learn the name — check_codec's
allow-list and containers_for. The first is how the initial attempt silently
produced an 8-bit file for --codec h264_10bit: the name was rejected upstream
and ffmpeg_args never saw it, while the .mp4 left over from the previous run
made it look like it had worked. The end-to-end check is the only reason that was
caught.

Verified with ffprobe:

default              h264,High,yuv420p
--codec h264_10bit   h264,High 10,yuv420p10le

The docs claimed 10-bit as the default in four places — README.md, CLAUDE.md,
SKILL.md and rules/gradient-quality.md — and gradient-quality.md recommended
ProRes for dark gradients without mentioning that 10-bit H.264 was already on. All
four now say which of the two trades away playback, and why 10-bit is not the
default: the reason is not quality.

Tests

the_default_h264_output_is_eight_bit, ten_bit_is_still_reachable_by_asking_for_it,
an_unknown_codec_name_falls_back_to_the_playable_default, and three in
validation.rs pinning that every name ffmpeg_args branches on is accepted by
check_codec — which is the invariant that broke.

Not in this PR

The release itself. main is well ahead of the 0.7.0 on crates.io, and #435 asks
for a version bump, a changelog and a publish. Publishing is outward-facing and
cannot be undone, so it is yours to run. There is also no CHANGELOG.md in the
repository, so the format is a decision rather than a fill-in.

cargo fmt --all --check clean · cargo test -p rustmotion --lib encode::video::ffmpeg cli::commands::validation 45 passed. The full workspace run is the orchestrator's after the parallel workstreams integrate.