fix(plugin-report): guard the CSV header row too — a matrix's across headers are data values

Claude-Session: https://claude.ai/code/session_01JQwxbYfDeaywgrS5N1PZfg
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

ui/packages/plugin-report/src/ReportExport.tsx

@@ -123,7 +123,9 @@ function csvField(text: string): string {
 /** The CSV text of a snapshot (CRLF rows, RFC 4180 quoting). */
 export function buildReportCsv(snapshot: ReportTableSnapshot, includeHeaders: boolean): string {
   const lines: string[] = [];
-  if (includeHeaders) lines.push(snapshot.header.map(csvField).join(','));
+  // A matrix's across-axis headers ARE dimension values from the data, so every
+  // header cell takes the guard (an authored label never opens with = + - @ |).
+  if (includeHeaders) lines.push(snapshot.header.map((h) => csvField(guardFormula({ text: h, fromData: true }))).join(','));
   for (const row of snapshot.rows) lines.push(row.map((c) => csvField(guardFormula(c))).join(','));
   return lines.join('\r\n');
 }

ui/packages/plugin-report/src/__tests__/DatasetReportRenderer.export-25873.test.tsx

@@ -283,6 +283,35 @@ describe('report export control (exportOptions, #25873)', () => {
     expect(downloads[0].fileName).toMatch(/^by_stage_quarter-/);
   });
 
+  it('a matrix across-axis value opening with a formula character is guarded in the CSV header', async () => {
+    const result = {
+      rows: [
+        { stage: 'A', quarter: '=HYPERLINK("x")', amount: 1 },
+        { stage: 'A', quarter: 'Q2', amount: 2 },
+      ],
+      fields: [
+        { name: 'stage', type: 'string', label: 'Stage' },
+        { name: 'quarter', type: 'string', label: 'Quarter' },
+        { name: 'amount', type: 'number', label: 'Amount' },
+      ],
+      object: OBJECT,
+    };
+    renderReport(
+      { name: 'by_stage_quarter', type: 'matrix', dataset: 'opportunity_metrics', rows: ['stage'], columns: ['quarter'], values: ['amount'] },
+      { result },
+    );
+    await screen.findByTestId('dataset-matrix');
+    await openMenu();
+    fireEvent.click(await screen.findByTestId('report-export-csv'));
+    await waitFor(() => expect(downloads).toHaveLength(1));
+    const header = parseCsv(await blobText(downloads[0].blob))[0];
+    expect(drawnTable()[0]).toContain('=HYPERLINK("x")');
+    expect(header).toContain('\t=HYPERLINK("x")');
+    expect(header).not.toContain('=HYPERLINK("x")');
+    // Authored labels pass through unchanged.
+    expect(header[0]).toBe('Stage');
+  });
+
   it('a joined report draws no export control', async () => {
     renderReport({
       name: 'joined_one',