Relabel post-manifest-parse failure as TooNew; refuse zero-length package entries at encode

An additively-tagged newer package that fails to parse now reports TooNew (with
writer semver) instead of unactionable Malformed. Format layer also refuses encoding
a zero-length entry, honoring the shell's appendPayload contract; both test-covered.

tests/test_package_manifest.cpp

@@ -64,7 +64,7 @@ static PackageManifest fixture() {
     m.bankDisplayName = "Drums \"live\"";  // escaping exercised
     m.exportTimestamp = 1754100000;
     m.entries.push_back({"kick.wav", 96000, "1111222233334444", fullSample()});
-    m.entries.push_back({"snare.wav", 0, "5555666677778888", bareSample()});  // 0-length legal
+    m.entries.push_back({"snare.wav", 48000, "5555666677778888", bareSample()});
     m.slots.append("smp-full");
     m.slots.append("smp-bare");
     m.slots.remove("smp-full");  // leaves a gap: slots round-trip must keep it
@@ -173,6 +173,16 @@ static void testDuplicateEntriesKeyRejected() {
 
 // --- rejection: structural ---------------------------------------------------
 
+// A zero-length entry cannot round-trip through the shell's filesystem seam
+// (src/shell/package's appendPayload refuses an empty payload) — the format
+// layer must never produce one, so encode refuses it. Decode does not enforce
+// this (a hostile/older package declaring one is not this codec's concern).
+static void testEncodeRejectsZeroLengthEntry() {
+    PackageManifest m = fixture();
+    m.entries[0].byteLength = 0;
+    CHECK(!serializeManifest(m).has_value());
+}
+
 static void testEncodeRejectsUnrepresentableSample() {
     PackageManifest m = fixture();
     m.entries[0].sample.id.clear();  // BankModel::add rejects an empty id
@@ -253,6 +263,7 @@ int main() {
     testDecodeRejectsBadEntryName();
     testDuplicateEntryNamesRejectedBothWays();
     testDuplicateEntriesKeyRejected();
+    testEncodeRejectsZeroLengthEntry();
     testEncodeRejectsUnrepresentableSample();
     testDecodeRejectsMalformedShapes();