Close package fs review findings: readRange bounds, picker ext, non-ASCII tests

Cap readRange's allocation and reject size_t overflow instead of truncating;
re-append .rsbank when the export picker omits it; add cafe coverage for
writeFileExclusive and writeLandedFile; loop write() on EINTR.

src/shell/package/package_rollback.h

@@ -19,6 +19,10 @@ struct RollbackResult {
     bool refused = false;        // markIndexCommitted() ran: nothing was deleted
 };
 
+// Destroying an armed (uncommitted, un-rolled-back) journal is NOT an implicit
+// rollback — the caller must call rollback() itself on the failure path it wants
+// to undo. That's the fail-safe direction: a journal dropped by an unrelated early
+// return leaves the landed files in place rather than silently deleting them.
 class LandedFileJournal {
 public:
     // Lands one payload at destPath through the exclusive create (which refuses an
@@ -33,7 +37,9 @@ public:
     // Disarms the journal: the index mutation these files back is committed, so they
     // are now referenced bytes and the carve-out no longer covers them. This is the
     // half of prune's discriminator the journal cannot make structural on its own —
-    // the import verb MUST call it at the moment the index is committed.
+    // the import verb MUST call this only AFTER the index write has returned success.
+    // Calling it before, then having that write fail, strands the landed files with
+    // no index entry and a journal that now refuses to roll them back.
     void markIndexCommitted() { indexCommitted_ = true; }
     bool indexCommitted() const { return indexCommitted_; }