Close package fs review findings: readRange bounds, picker ext, non-ASCII tests

Cap readRange's allocation and reject size_t overflow instead of truncating;
re-append .rsbank when the export picker omits it; add cafe coverage for
writeFileExclusive and writeLandedFile; loop write() on EINTR.

src/shell/package/package_rollback.cpp

@@ -24,7 +24,7 @@ bool LandedFileJournal::writeLandedFile(const std::string& destPath,
     std::error_code ec;
     const fs::path resolved = fs::absolute(utf8Path(destPath), ec);
     if (ec) return false;
-    const std::string absPath = resolved.u8string();
+    const std::string absPath = pathToUtf8(resolved);
 
     if (!writeFileExclusive(absPath, payload)) return false;
     paths_.push_back(absPath);