Record parseSlots exemption and fix stale package doc comments

Documents why parseSlots skips repeat-key rejection, corrects two drifted doc
lines (naming-rule count, Malformed-after-header header validity), and records
two forward obligations for import_plan in CLAUDE.md.

src/core/package/package_manifest.cpp

@@ -84,7 +84,14 @@ std::optional<std::string> serializeManifest(const PackageManifest& m) {
 namespace {
 
 // Mirrors bank_book_json's private slots parser: [{id, slot}, ...] pairs handed
-// to SlotMap::fromEntries, which owns the defensive repair rules.
+// to SlotMap::fromEntries, which owns the defensive repair rules. Deliberately
+// does NOT reject a repeated "id"/"slot" key the way the root and entry parsers
+// below reject theirs — this grammar belongs to core/model's bank_book_json, and
+// diverging here would give one wire shape two behaviours in two files. The
+// stakes differ too: a repeated "name" decides which file an entry lands on,
+// while a repeated "id" here still feeds SlotMap::fromEntries's deterministic
+// first-wins/never-double-occupy repair, so no ambiguity survives. Do not
+// "finish" the repeat-key rejection here to match the parsers below.
 bool parseSlots(json::Reader& r, model::SlotMap& out) {
     std::vector<std::pair<std::string, int>> pairs;
     if (!r.consume('[')) return false;