[KreutzM]

Summary

Adds a production-quality, resumable frame-sequence export that renders an existing offline frame plan into a directory of deterministic PNG frames, plus a fractal-render export-frames CLI command. No camera, cadence, tone-mapping or numerical semantics changed; the feature strictly reuses build_offline_frame_plan, render_offline_frames and the existing request/camera-path contracts.

New module frame_sequence_export.py:

• FrameSequenceSettings — validated image format (PNG), {index} filename pattern (bare filename, exactly one placeholder, matching extension), overwrite policy.
• parse_frame_range — inclusive-start/exclusive-stop range validation against the plan.
• export_frame_sequence — renders a range, verifies/skips existing completed frames (RGB mode + plan size) unless overwrite=True, re-validates each rendered frame (shape/dtype), publishes atomically (unique .part file + os.replace, temporary cleanup on any failure), supports cooperative cancellation between frames with FrameSequenceResult.next_start_index() resume reporting, optional temporal tone planning (from index 0 only, matching the analysis contract), progress callbacks and surface lighting pass-through. The output directory is created only once the run reaches publication.
• Tk-independent; works fully on the CPU path.
• CLI failures (invalid pattern, corrupt existing frame, renderer failure, cancelled tone analysis) exit via SystemExit with a clear export-frames: … message; unexpected errors and KeyboardInterrupt still surface normally.

Issue

Closes #3

Design / Decisions

• One new durable component boundary (frame_sequence_export.py) documented in docs/ARCHITECTURE.md; file publication is separated from frame production like the MP4 layer separates encoding.
• Resume detection is existence + validity of the exact planned filename (no sidecar manifest): atomic publication guarantees an existing regular file at the plan path is a complete, re-openable RGB PNG of plan size; corrupt or wrong-sized files fail loudly instead of being silently replaced.
• Frame validity is mode/size verification, not pixel hashing; byte-determinism of the pipeline is covered by test_frames_match_render_offline_frames_output.
• GUI/export-dialog integration intentionally excluded (issue allows it as a child task); CLI exposure included as suggested decomposition step 2.

Validation

Local (Linux WSL, .venv, CPU backend):

• pytest -q: 368 passed (18 tests in tests/test_frame_sequence_export.py, 2 new CLI tests in tests/test_service_and_cli.py).
• scripts/check_pan_stability.py --backend cpu: STABLE.
• Manual CLI smoke against examples/flight_plans/twin-spiral-nocturne.fractal-flight.json (521-frame plan): chunk render, then resume with larger --stop → "2 rendered, 3 skipped".

GitHub CI on final head 2b0329a: all 8 checks pass — Tests ubuntu-latest 3.11/3.12/3.13, Tests windows-latest 3.11/3.12/3.13, GUI+stability+wheel, Source ZIP and Git bundle.

Independent review loop (fresh reviewer subagents per .hermes.md §14):

• Round 1: 1 BLOCKER (--filename-pattern parsed but not forwarded in the CLI) + 4 MINOR + 2 NIT → all fixed in 7f7b1b8.
• Round 2: verdict ready, 1 MINOR (CLI except clause missed OfflineFrameRenderError/Mp4ExportCancelled) + 1 NIT (duplicate separators) + empty-dir-on-error observation → all fixed in 2b0329a.
• Round 3 (convergence, fresh reviewer): verdict READY, no unresolved actionable findings; round-1/2 fixes independently verified, full spec-compliance table confirmed, 368/368 tests confirmed passing.

Not executed / pending: physical CUDA hardware tests (not required — renderer internals unchanged); Windows local GUI runs beyond CI (CI covers windows-latest headless tests).

Remaining / Follow-ups

• GUI export-dialog integration for frame sequences (candidate child issue per the issue's decomposition step 3).
• Non-PNG image formats if ever requested (extension point is _SUPPORTED_IMAGE_FORMATS).

Handoff

Branch agent/3-frame-sequence-export, head 2b0329a, based on current main. Three-round independent review converged on ready; CI fully green. Awaiting explicit user merge authorization — not merged.