IsWellFormedPackage sums the package weight with std::accumulate starting from a plain 0, so the running total is an int. A package heavier than INT_MAX would wrap and could pass the MAX_PACKAGE_WEIGHT check. No package that large reaches this check today, since RPC request bodies are capped at 32 MiB and P2P messages at 4 MB, so this is defense in depth. It picks up the one-line fix from #35473, which was closed with an invitation to do so.
I start the sum from int64_t{0}, as the vsize sum in validation.cpp already does. I did not add a test, since the one on #35473 was turned down. I checked the fix locally with a throwaway test that puts one transaction of 88M weight into a package 25 times: before the fix the package is rejected as package-contains-duplicates, after it as package-too-large.
