Close package fs review findings: readRange bounds, picker ext, non-ASCII tests

Cap readRange's allocation and reject size_t overflow instead of truncating;
re-append .rsbank when the export picker omits it; add cafe coverage for
writeFileExclusive and writeLandedFile; loop write() on EINTR.

src/shell/package/package_path.h

@@ -1,9 +1,9 @@
-// shell/package/package_path — the ONE narrow-string -> fs::path conversion for this
-// seam. std::filesystem decodes a narrow path through the RUNTIME ANSI code page on
-// Windows (measured: GetACP() == 1252 here), never UTF-8, so a bare
+// shell/package/package_path — the ONE narrow-string <-> fs::path conversion pair for
+// this seam. std::filesystem decodes a narrow path through the RUNTIME ANSI code page
+// on Windows (measured: GetACP() == 1252 here), never UTF-8, so a bare
 // fs::path(std::string) turns every non-ASCII path this repo's UTF-8 convention
 // produces into mojibake. u8path is the C++17 spelling; it is deprecated in C++20, so
-// a standard bump replaces the body here rather than at every call site.
+// a standard bump replaces both bodies here rather than at every call site.
 
 #pragma once
 
@@ -16,4 +16,11 @@ inline std::filesystem::path utf8Path(const std::string& utf8) {
     return std::filesystem::u8path(utf8);
 }
 
+// u8string() returns std::u8string in C++20 — this is the one place that narrows it
+// back to std::string, so a standard bump only widens this one body.
+inline std::string pathToUtf8(const std::filesystem::path& path) {
+    const auto u8 = path.u8string();
+    return std::string(u8.begin(), u8.end());
+}
+
 }  // namespace reasampler