Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

src/shell/actions/package_export_action.cpp

@@ -164,7 +164,8 @@ void doBankPackageExport(const ReaSamplerSession& session, const std::string& ba
     const std::string suggested =
         projectDir + "/" + capture::sanitizeStem(bankName) + ".rsbank";
     std::string dest;
-    if (!pickPackageSavePath(suggested, dest)) return;  // user cancelled the picker
+    bool appended = false;
+    if (!pickPackageSavePath(suggested, dest, &appended)) return;  // user cancelled the picker
 
     ExportRequest req;
     req.projectDir = projectDir;
@@ -172,6 +173,11 @@ void doBankPackageExport(const ReaSamplerSession& session, const std::string& ba
     req.destAbsPath = dest;
     req.exportTimestamp = static_cast<std::int64_t>(std::time(nullptr));
     req.allowIncomplete = allowIncomplete;
+    // The dialog's own overwrite confirm covered exactly this path when the picker
+    // did not need to append `.rsbank` to reach it — asking again would be a second
+    // prompt for the same consent. An appended path is one the dialog never saw, so
+    // that case still falls through to exportBank's own refusal and the confirm below.
+    req.allowOverwrite = !appended;
 
     ExportOutcome out = exportBank(session, req);
     if (out.status == ExportStatus::RefusedDestinationExists) {