Close package fs review findings: readRange bounds, picker ext, non-ASCII tests

Cap readRange's allocation and reject size_t overflow instead of truncating;
re-append .rsbank when the export picker omits it; add cafe coverage for
writeFileExclusive and writeLandedFile; loop write() on EINTR.

tests/test_package_io.cpp

@@ -293,11 +293,22 @@ static void testWriteFileExclusiveRefusesAnOccupiedPath() {
     CHECK(writeFileExclusive(path, PayloadBuffer(mine)));
     CHECK(readAll(path) == mine);
     // The create IS the check: a second call cannot replace the first file's bytes.
+    // (this pins the refusal, not O_EXCL's atomicity — a genuine race isn't portable)
     CHECK(!writeFileExclusive(path, PayloadBuffer(patternBytes(9, 8))));
     CHECK(readAll(path) == mine);
     CHECK(!writeFileExclusive("pkg_io_excl_empty.bin", PayloadBuffer{}));
     CHECK(!exists("pkg_io_excl_empty.bin"));
     removeQuietly(path);
+
+    // writeFileExclusive is the one call site using the wstring()/c_str() Windows
+    // open form rather than the fstream(fs::path) overload every other test here
+    // exercises — the only conversion whose reversion this file would otherwise miss.
+    const std::string cafePath = "pkg_io_excl_caf\xC3\xA9.bin";
+    const std::vector<std::uint8_t> cafeBytes = patternBytes(6, 4);
+    CHECK(writeFileExclusive(cafePath, PayloadBuffer(cafeBytes)));
+    CHECK(readAll(cafePath) == cafeBytes);
+    CHECK(!writeFileExclusive(cafePath, PayloadBuffer(patternBytes(3, 9))));
+    removeQuietly(cafePath);
 }
 
 static void testListFolderFileNames() {