Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

src/shell/package/package_io.h

@@ -33,6 +33,11 @@ public:
 
     // Buffers currently holding at least one byte, process-wide.
     static int alive();
+    // The largest alive() has ever been, process-wide. A point-in-time alive() == 0
+    // check after a call returns cannot fail on a whole-package-in-memory shape that
+    // allocated N buffers and freed them all one at a time — highWaterMark() can,
+    // since it is never reset.
+    static int highWaterMark();
 
 private:
     void release();