Tighten RSBK package-format validation for review remediation

Reject NUL/control bytes and Windows-hostile names in entry names, relax
the over-broad ".." substring ban to component-only, close the
trailing-garbage gap on empty manifests, and relocate the package
CMake subdirectory to its ladder home.

tests/test_bank_package.cpp

@@ -95,13 +95,15 @@ static void appendManifest(std::vector<std::uint8_t>& out, const std::string& js
 }
 
 // One-entry manifest JSON with `extra` spliced in as additional root content
-// ("" for none) — for images a current writer would never emit.
+// ("" for none) and `sampleExtra` spliced into the nested Sample object — for
+// images a current writer would never emit.
 static std::string handManifest(const std::string& name, int length,
-                                const std::string& extra) {
+                                const std::string& extra,
+                                const std::string& sampleExtra = "") {
     return std::string("{") + extra +
            "\"entries\":[{\"name\":\"" + name +
            "\",\"length\":" + std::to_string(length) + ",\"hash\":\"h\","
-           "\"index\":{\"version\":1,\"samples\":[{\"id\":\"s1\","
+           "\"index\":{\"version\":1,\"samples\":[{\"id\":\"s1\"," + sampleExtra +
            "\"relativePath\":\"bank/a.wav\"}]}}]}";
 }
 
@@ -210,11 +212,14 @@ static void testTooNewProducesNoManifest() {
 // --- version ladder: additive forward compatibility --------------------------
 
 // The reason two integers exist: a NEWER formatVersion whose minReaderVersion
-// still reaches back to this build must read, with its unknown keys skipped.
+// still reaches back to this build must read, with its unknown keys skipped —
+// at the manifest level AND inside the nested Sample blob, the actual
+// motivating case for the two-integer ladder (see this directory's CLAUDE.md).
 static void testNewerAdditiveFormatReads() {
     const std::string manifest = handManifest(
         "a.wav", 4,
-        "\"instrumentState\":{\"future\":[1,2,3]},\"anotherNewKey\":\"x\",");
+        "\"instrumentState\":{\"future\":[1,2,3]},\"anotherNewKey\":\"x\",",
+        "\"someFutureSampleField\":42,");
     std::vector<std::uint8_t> bytes =
         rawHeader(kPackageFormatVersion + 1, kPackageMinReaderVersion, "1.9.0");
     appendManifest(bytes, manifest);