[Export] CSV downloads lack a UTF-8 BOM — Excel mangles non-ASCII text

[Exotic209093]

Severity

Medium — the primary consumer of a Salesforce CSV export displays Müller as Müller.

What happens

CSV blobs are built from raw strings with type: 'text/csv' and no \uFEFF. Windows Excel default-opens BOM-less UTF-8 CSV as ANSI. Verified live against the packaged 0.6.0 bundle: exported bytes start directly with Id, (no BOM). Applies to both the small and chunked (downloadBlobParts) paths.

Evidence

• src/ui/utils/download.ts:15-17

Suggested fix

Prepend '\uFEFF' as the first BlobPart when the content type is text/csv.

Environment

Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code + live harness verified).

[Exotic209093]

Fixed in #119