Fix M3 capture: render format, project rate, unsaved-project handling

RENDER_FORMAT now uses the base64 float-WAV config (raw bytes were rejected
into a 16-bit/44.1 fallback); RENDER_SRATE pinned to the project rate.
Unsaved projects prompt Save then refuse if cancelled — no default-location
fallback. Harden deriveBankPaths against empty projectDir.

src/capture_paths.cpp

@@ -1,5 +1,7 @@
 #include "capture_paths.h"
 
+#include <cassert>
+
 namespace reasampler {
 
 std::string normalizeSlashes(const std::string& path) {
@@ -51,13 +53,22 @@ BankPaths deriveBankPaths(const std::string& projectDir,
     }
     const std::string fileName = stem + ".wav";
 
+    // Precondition: the capture shell must resolve a non-empty project directory
+    // before calling this function. An empty projectDir would produce a bare
+    // relative "reasampler_bank" path — the silent default-location fallback this
+    // tool explicitly forbids. Assert in debug; leave absoluteDir empty in release
+    // so any caller that ignores the precondition fails loudly at the render/stat
+    // step rather than silently writing to CWD.
+    assert(!dir.empty() && "deriveBankPaths: projectDir must not be empty");
+
     BankPaths p;
     p.fileStem     = stem;                                    // stem only — REAPER appends extension
     p.fileName     = fileName;
     p.relativePath = std::string(kBankSubfolder) + "/" + fileName;
     // absoluteDir intentionally omits a trailing slash (RENDER_FILE wants the
     // directory itself; RENDER_PATTERN supplies the file name separately).
-    p.absoluteDir  = dir.empty() ? std::string(kBankSubfolder)
+    // Empty when precondition is violated (dir empty) — caller must not proceed.
+    p.absoluteDir  = dir.empty() ? std::string{}
                                  : dir + "/" + kBankSubfolder;
     return p;
 }