Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

docs/PLAN.md

@@ -2704,10 +2704,12 @@ on the import side, `bank_ops`, or `persist`.
 - Exporting an empty bank produces a valid, importable package with zero entries rather than
   refusing. An empty bank is a legitimate thing to carry.
 
-**Open questions.** **[propose at review]** whether the export affordance is action-only,
-panel-only, or both at ship. **[propose at review]** whether the default file name is derived
-from the bank's display name (recommended, sanitized through
-`capture_paths::sanitizeStem`) or from the project name.
+**Open questions — both answered at implementation review, recorded at
+`docs/product/bank-package.md` §"Implementation decisions — Ε-W2-T1".** Affordance:
+**both** the action and the panel row (the action is the only spelling that can reach
+the pool; the panel row is the direct gesture on a named bank). Default file name:
+the bank's **display name**, sanitized through `capture_paths::sanitizeStem`, as
+recommended.
 
 #### Ε-W2-T2 — `bank-import`