Fix the package fs seam: UTF-8 paths, GetUserFileName pickers, exclusive-create landing, rollback arm/disarm

Both pickers now ride GetUserFileName (mode 0/1); the "no save picker" premise was false.
Landing uses O_EXCL so the create is the existence check, not a TOCTOU pair.

src/shell/package/package_path.h

@@ -0,0 +1,19 @@
+// shell/package/package_path — the ONE narrow-string -> fs::path conversion for this
+// seam. std::filesystem decodes a narrow path through the RUNTIME ANSI code page on
+// Windows (measured: GetACP() == 1252 here), never UTF-8, so a bare
+// fs::path(std::string) turns every non-ASCII path this repo's UTF-8 convention
+// produces into mojibake. u8path is the C++17 spelling; it is deprecated in C++20, so
+// a standard bump replaces the body here rather than at every call site.
+
+#pragma once
+
+#include <filesystem>
+#include <string>
+
+namespace reasampler {
+
+inline std::filesystem::path utf8Path(const std::string& utf8) {
+    return std::filesystem::u8path(utf8);
+}
+
+}  // namespace reasampler