Remediate Ε-W3-T1 package-compat-fixtures review findings

Freeze *.rsbank as binary via .gitattributes; add a truncated additive_forward fixture proving the exact-size proof beats TooNew; enumerate the fixture dir to catch orphaned files; make fixture-size checks fatal instead of just logged; pin fixture version asserts as literals, not build-relative.

src/shell/package/CMakeLists.txt

@@ -41,7 +41,7 @@ reasampler_test(package_round_trip
          tail_control origin_ledger tracking_authority prune_reconcile app_version
          capture_paths wav_codec)
 target_compile_definitions(package_round_trip_tests PRIVATE
-    REASAMPLER_PACKAGE_FIXTURE_DIR="${REASAMPLER_TESTS_DIR}/fixtures/package_compat")
+    REASAMPLER_PACKAGE_FIXTURE_DIR="${REASAMPLER_PACKAGE_FIXTURE_DIR}")
 
 # The pickers call the REAPER API, so no test target can exercise them; declared as a
 # library so the TU stays compiled. reaper_plugin.h pulls SWELL in on non-Windows.