Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

src/shell/package/export_bank.h

@@ -2,8 +2,12 @@
 // stream, commit. No prompts and no message boxes (shell/actions/
 // package_export_action is the skin). The session arrives CONST, which is how "an
 // export writes no ext state, opens no undo point and never bumps the bank
-// generation" is enforced rather than remembered — every mutator on the session is
-// non-const. Blocking I/O: UI-thread actions only.
+// generation" is enforced rather than remembered — those three acts
+// (saveToActiveProject, bumpBankGeneration, writeAssignmentRequest) are exactly the
+// session members that are non-const (session.h:113,108,147). Constness does not
+// block every mutation, though: pruneReclaim (session.h:140-141) is const and is
+// the system's sole file-deletion path — irrelevant to export, but not something a
+// const session forbids in general. Blocking I/O: UI-thread actions only.
 
 #pragma once