Close package fs review findings: readRange bounds, picker ext, non-ASCII tests

Cap readRange's allocation and reject size_t overflow instead of truncating;
re-append .rsbank when the export picker omits it; add cafe coverage for
writeFileExclusive and writeLandedFile; loop write() on EINTR.

src/shell/package/package_io.h

@@ -89,7 +89,9 @@ public:
     bool ok() const { return ok_; }
     std::uint64_t fileSize() const { return size_; }
     // Bytes [offset, offset+length). Range-checked against the real file size, so a
-    // hostile layout can never demand an allocation past the file's end.
+    // hostile layout can never demand an allocation past the file's end, and capped
+    // against a 4 GiB sanity ceiling so a merely large-but-real file can't still
+    // force a multi-gigabyte allocation out of one call.
     PayloadBuffer readRange(std::uint64_t offset, std::uint64_t length);
 
 private: