Close bank-export review findings: name-cap underflow, double overwrite prompt, test scope

Clamps insertSuffix's underflow, floors uniqueEntryName's validity guard, suppresses
the redundant overwrite confirm via a picker out-param, adds a PayloadBuffer
high-water mark, and corrects stale CLAUDE.md/CMake claims.

tests/test_export_plan.cpp

@@ -167,6 +167,27 @@ static void testHostileNamesAreRepairedNotRelayed() {
     }
 }
 
+static void testUniqueNameSurvivesLongExtensionUnderflow() {
+    // insertSuffix computes room = kMaxEntryNameBytes - suffix.size() - ext.size() in
+    // size_t; an extension long enough that even a two-digit "_10" suffix pushes the
+    // sum past the cap must not wrap that subtraction. Ten same-named entries force
+    // the tenth collision into double digits against a 253-byte extension (253 + 3 =
+    // 256, one over kMaxEntryNameBytes).
+    const std::string hostileName = "a." + std::string(252, 'x');  // 254 bytes, otherwise valid
+    std::vector<ExportCandidate> candidates;
+    for (int i = 0; i < 10; ++i)
+        candidates.push_back(present("s" + std::to_string(i), "reasampler_bank/" + hostileName));
+
+    const ExportPlan p = planExport(bankOf(candidates));
+    CHECK(p.verdict == ExportVerdict::Ready);
+    CHECK(p.manifest.entries.size() == 10);
+    for (const PackageEntry& e : p.manifest.entries) CHECK(isValidEntryName(e.fileName));
+    for (std::size_t i = 0; i < p.manifest.entries.size(); ++i)
+        for (std::size_t j = i + 1; j < p.manifest.entries.size(); ++j)
+            CHECK(!sameEntryName(p.manifest.entries[i].fileName,
+                                 p.manifest.entries[j].fileName));
+}
+
 static void testCaseFoldedCollisionsAreDisambiguated() {
     const ExportPlan p = planExport(bankOf({
         present("s1", "reasampler_bank/Kick.wav"),
@@ -253,6 +274,7 @@ int main() {
     testUnreadableFileStaysDistinctFromMissing();
     testUnrepresentableRecordRefusesWholeExport();
     testHostileNamesAreRepairedNotRelayed();
+    testUniqueNameSurvivesLongExtensionUnderflow();
     testCaseFoldedCollisionsAreDisambiguated();
     testSanitizeNeverReturnsANameTheCodecRefuses();
     testPlannedManifestSatisfiesTheCodec();