Relabel post-manifest-parse failure as TooNew; refuse zero-length package entries at encode

An additively-tagged newer package that fails to parse now reports TooNew (with
writer semver) instead of unactionable Malformed. Format layer also refuses encoding
a zero-length entry, honoring the shell's appendPayload contract; both test-covered.

src/core/package/package_manifest.cpp

@@ -43,8 +43,12 @@ bool PackageManifest::operator==(const PackageManifest& o) const {
 }
 
 std::optional<std::string> serializeManifest(const PackageManifest& m) {
-    for (const auto& e : m.entries)
+    for (const auto& e : m.entries) {
         if (!isValidEntryName(e.fileName)) return std::nullopt;
+        // Cross-module contract with src/shell/package — see this directory's
+        // CLAUDE.md.
+        if (e.byteLength == 0) return std::nullopt;
+    }
     if (duplicateName(m.entries)) return std::nullopt;
 
     std::string out;