Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

docs/product/bank-package.md

@@ -725,6 +725,30 @@ contemplates one untracked capture, an import strands hundreds).
 
 ---
 
+## Implementation decisions — Ε-W2-T1
+
+Not [Daniel]-class forks — both were `[propose at review]` calls in `docs/PLAN.md`'s
+Ε-W2-T1 track, answered at implementation review rather than by Daniel, and recorded
+here per this phase's own convention for keeping such answers where the design lives
+rather than only in the track's own now-stale open-questions line.
+
+- **Affordance: both the bindable action and the panel row.** The action targets the
+  **active** bank and is the only spelling that can reach the **pool** (the panel's
+  `showTabMenu` returns early on `isPool()` — a named-bank-tab context menu has no tab
+  to right-click for the pool), while the exported unit's own definition above includes
+  the pool. The panel row is the direct gesture on a specific named bank. Neither
+  subsumes the other.
+- **Default file name: the bank's display name**, sanitized through
+  `capture_paths::sanitizeStem`, seeded into `<projectDir>/<stem>.rsbank`. A
+  project-derived name was the rejected alternative: three banks exported from one
+  project must produce three distinguishable files, and a project-derived name
+  collides on the second export. Known wart, worth recording rather than hiding:
+  `sanitizeStem` collapses an all-non-ASCII display name to the literal `capture`, so
+  two such banks still collide — the existing rename verb is the recovery, same as the
+  import-side auto-suffix collisions above.
+
+---
+
 ## Non-goals and guardrails
 
 - **No auto-insertion of imported audio into the arrange.** Same rule as capture.