Export a ProjectFile's tasks to CSV. Quoting follows RFC 4180 and triggers on a bare CR as well as comma/quote/LF, since a lone CR can desync strict parsers. Fields beginning with a formula trigger (=, +, -, @) are defanged with a leading apostrophe per OWASP guidance, and the trigger set is a named constant so the policy is auditable in one place. Adds shared test helpers (parseCsv, makeMinimalProject) reused by the CSV, XLSX, and library suites.