V3 deterministic media-download capability pack. By-value cli composition (service_kind=cli, no separate service ingredient): one local yt-dlp CLI ingredient exposes readiness, URL metadata JSON, available format listing, and detached media download. Metadata and format inspection are read-tier but approval=ask because yt-dlp contacts the remote URL; they do not download media or write output files. The media.download operation is launched as a Recued-managed DETACHED one-shot job (NOT a supervised daemon): a download realistically runs for many minutes past the foreground execution cap, so the launcher detaches the child, redirects output to {result_dir}/{key}.log, and writes {result_dir}/{key}.pid + the {result_dir}/{key}.exit.<code> completion marker. The downloaded media lands at {result_dir}/{key}.<ext> and a downstream D-179 sweeper recipe reconciles marker/log evidence; the log carries the exact `[download] Destination:` path. All URL operations ignore user config files, browser cookies, cookie files, and persistent cache by default so pack behavior is bounded and does not silently inherit local account state. Requires the yt-dlp binary on PATH (pip install --user yt-dlp). Replaces the retired yt-dlp-{linux,macos,win} service templates.