Please address the comments from this code review:

## Overall Comments
- When running `mcap recover`, consider writing to a temporary file and then atomically moving it over the original path to avoid corrupting the only copy if the recover process produces a bad or partial file.
- You can simplify the subprocess handling by using `text=True` (or `encoding="utf-8"`, `errors="ignore"`) in `create_subprocess_exec` instead of manually decoding `stdout`/`stderr` bytes in both the doctor and recover calls.
- The `check_and_recover_mcap` function currently logs full stdout/stderr for both doctor and recover; consider truncating or summarizing very large outputs to keep logs readable and to avoid log bloat on large or noisy files.

## Individual Comments

### Comment 1
<location> `core/services/recorder_extractor/main.py:111-120` </location>
<code_context>
+    and if it fails, run mcap recover to fix the file.
+    """
+    # Check if mcap binary exists
+    mcap_binary = shutil.which("mcap")
+    if not mcap_binary:
+        logger.warning("mcap binary not found, skipping doctor/recover check")
+        return
+
+    # Ensure path is absolute and exists
+    if not mcap_path.exists():
+        logger.warning(f"MCAP file not found: {mcap_path}")
+        return
+
+    logger.info(f"Running mcap doctor on {mcap_path}")
+    # Run mcap doctor
+    doctor_cmd = ["mcap", "doctor", str(mcap_path)]
+    doctor_proc = await asyncio.create_subprocess_exec(
+        *doctor_cmd,
</code_context>

<issue_to_address>
**suggestion (bug_risk):** Use the resolved `mcap_binary` path for commands instead of hardcoding "mcap".

You already resolve the `mcap` binary with `shutil.which`, but `doctor_cmd` and `recover_cmd` still call the hardcoded `"mcap"`. Please use `mcap_binary` instead (e.g. `doctor_cmd = [mcap_binary, "doctor", str(mcap_path)]`) so the invoked binary always matches what was found on PATH.

Suggested implementation:

```python
    logger.info(f"Running mcap doctor on {mcap_path}")
    # Run mcap doctor
    doctor_cmd = [mcap_binary, "doctor", str(mcap_path)]

```

Search in `check_and_recover_mcap` for where `recover_cmd` is defined (likely later in the function) and update it similarly:

- Change `recover_cmd = ["mcap", "recover", ...]` to `recover_cmd = [mcap_binary, "recover", ...]`.

This ensures both doctor and recover invocations use the same resolved `mcap_binary` path from `shutil.which("mcap")`.
</issue_to_address>

### Comment 2
<location> `core/services/recorder_extractor/main.py:141` </location>
<code_context>
+    logger.error(f"mcap doctor failed for {mcap_path} (code={doctor_proc.returncode}): {stderr}")
+    logger.info(f"Running mcap recover to fix {mcap_path}")
+    # Run mcap recover to replace the file
+    recover_cmd = ["mcap", "recover", str(mcap_path), "-o", str(mcap_path)]
+    recover_proc = await asyncio.create_subprocess_exec(
+        *recover_cmd,
</code_context>

<issue_to_address>
**issue (bug_risk):** Writing recover output directly over the input file risks data loss on partial failures.

Because input and `-o` output paths are identical, a partial write or mid-run failure from `mcap recover` could corrupt the file with no untouched copy left. Consider writing to a temp file in the same directory and only replacing the original on success (e.g., via `Path.replace`) so the original remains intact if recovery fails.
</issue_to_address>