Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

docs/PLAN.md

@@ -2704,10 +2704,12 @@ on the import side, `bank_ops`, or `persist`.
 - Exporting an empty bank produces a valid, importable package with zero entries rather than
   refusing. An empty bank is a legitimate thing to carry.
 
-**Open questions.** **[propose at review]** whether the export affordance is action-only,
-panel-only, or both at ship. **[propose at review]** whether the default file name is derived
-from the bank's display name (recommended, sanitized through
-`capture_paths::sanitizeStem`) or from the project name.
+**Open questions — both answered at implementation review, recorded at
+`docs/product/bank-package.md` §"Implementation decisions — Ε-W2-T1".** Affordance:
+**both** the action and the panel row (the action is the only spelling that can reach
+the pool; the panel row is the direct gesture on a named bank). Default file name:
+the bank's **display name**, sanitized through `capture_paths::sanitizeStem`, as
+recommended.
 
 #### Ε-W2-T2 — `bank-import`
 

docs/product/bank-package.md

@@ -725,6 +725,30 @@ contemplates one untracked capture, an import strands hundreds).
 
 ---
 
+## Implementation decisions — Ε-W2-T1
+
+Not [Daniel]-class forks — both were `[propose at review]` calls in `docs/PLAN.md`'s
+Ε-W2-T1 track, answered at implementation review rather than by Daniel, and recorded
+here per this phase's own convention for keeping such answers where the design lives
+rather than only in the track's own now-stale open-questions line.
+
+- **Affordance: both the bindable action and the panel row.** The action targets the
+  **active** bank and is the only spelling that can reach the **pool** (the panel's
+  `showTabMenu` returns early on `isPool()` — a named-bank-tab context menu has no tab
+  to right-click for the pool), while the exported unit's own definition above includes
+  the pool. The panel row is the direct gesture on a specific named bank. Neither
+  subsumes the other.
+- **Default file name: the bank's display name**, sanitized through
+  `capture_paths::sanitizeStem`, seeded into `<projectDir>/<stem>.rsbank`. A
+  project-derived name was the rejected alternative: three banks exported from one
+  project must produce three distinguishable files, and a project-derived name
+  collides on the second export. Known wart, worth recording rather than hiding:
+  `sanitizeStem` collapses an all-non-ASCII display name to the literal `capture`, so
+  two such banks still collide — the existing rename verb is the recovery, same as the
+  import-side auto-suffix collisions above.
+
+---
+
 ## Non-goals and guardrails
 
 - **No auto-insertion of imported audio into the arrange.** Same rule as capture.