Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

src/shell/package/CMakeLists.txt

@@ -1,7 +1,8 @@
 # The filesystem + dialog seam for bank packages. package_io / package_rollback are
 # REAPER-free (standard filesystem only), so the pure-library/test helpers fit and
-# their tests run without a DAW. The export/import verbs that drive all three targets
-# are not in this directory yet.
+# their tests run without a DAW. export_bank, the promptless export verb, lives here
+# too for the same reason (ReaSamplerSession's inline accessors keep it REAPER-free);
+# the import verb does not live here yet.
 
 reasampler_pure_library(package_io SOURCES package_io.cpp)
 reasampler_test(package_io LINK package_io)
@@ -11,9 +12,15 @@ reasampler_test(package_rollback LINK package_rollback)
 
 # export_bank reads the live session through ReaSamplerSession's INLINE accessors only,
 # so it pulls in no REAPER-facing TU and its tests link (and run) without a DAW.
+# bank_book / tail_control / origin_ledger / tracking_authority / prune_reconcile /
+# app_version / view_mode_model are session.h's own transitive includes (BankBook::bank()
+# in particular is out-of-line, in bank_book.cpp) — declared here, on the library that
+# actually needs them, rather than left for every consumer to enumerate.
 reasampler_pure_library(export_bank
     SOURCES export_bank.cpp
-    LINK PUBLIC export_plan bank_package package_io PRIVATE capture_paths wav_codec)
+    LINK PUBLIC export_plan bank_package package_io
+         PRIVATE capture_paths wav_codec bank_book tail_control origin_ledger
+                 tracking_authority prune_reconcile app_version view_mode_model)
 reasampler_test(export_bank
     LINK export_bank bank_book slot_map view_mode_model tail_control origin_ledger
          tracking_authority prune_reconcile app_version capture_paths)