Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

src/core/package/CLAUDE.md

@@ -6,8 +6,8 @@ The hand-rolled `RSBK` bank-package container, entirely pure (REAPER-free,
 unit-tested outside the DAW): the format contract and version ladder, the JSON
 manifest, and the framing/layout codec. No filesystem — the shell
 (`src/shell/package`) streams bytes against the layouts produced here. The
-export/import *decisions* (`export_plan` / `import_plan`) are separate modules
-landing after the format.
+export/import *decisions* (`export_plan` / `import_plan`) are separate modules;
+`export_plan` has landed, `import_plan` has not.
 
 ## Invariants
 
@@ -123,12 +123,20 @@ landing after the format.
   corruption.
 - **A written package carries no path in ANY field.** `isValidNestedSamplePath`
   permits a relative `relativePath` because a *record* may hold one, but
-  `export_plan` writes each shipping entry's `relativePath` as its bare package
-  name, so an emitted manifest has no separator anywhere and the entry name is the
-  single naming authority on both sides. The directory component it drops carries
-  no information — the bank subfolder is a fixed `capture_paths` constant the
-  importer re-spells. The nested-path rule stays as the decode-side backstop for a
-  package this build did not write.
+  `export_plan` writes each shipping entry's `relativePath` as its bare, sanitized
+  and disambiguated transport name (`export_plan.cpp`'s `e.fileName`), so an
+  emitted manifest has no separator anywhere and the entry name is the single
+  naming authority on both sides. The directory component it drops carries no
+  information — the bank subfolder is a fixed `capture_paths` constant
+  (`capture_paths.cpp`'s `deriveBankPaths`) the importer re-spells. **The
+  basename spelling is dropped too, not just the directory**: `e.fileName` is
+  `uniqueEntryName(sanitizeEntryName(...))`, not the source basename, so a
+  macOS-authored `Hit?.wav` survives only in `displayName` — the transport name
+  itself may differ. Accepted for the same reason the directory drop is: the
+  transport name exists to be a valid, collision-free package entry, not a
+  faithful copy of the source spelling, and `displayName` is the field that
+  carries the original for display. The nested-path rule stays as the decode-side
+  backstop for a package this build did not write.
 - **Obligation on the export track: sanitize, don't relay the refusal.**
   `serializeManifest` returns one indistinguishable `nullopt` for every rejection
   — an unrepresentable name, a case-folded collision, a traversing nested path, a