Escape spreadsheet formulas in CSV export

[MsfPablo]

Fixes #915.

--export-csv writes the command name and every parameter value verbatim. Excel, LibreOffice Calc and Google Sheets evaluate a cell starting with =, +, -, @, tab or CR as a formula when the file is opened, so a benchmark parameterized over externally-supplied values produces a CSV that runs an attacker-chosen formula for whoever opens it (CWE-1236).

This applies the standard mitigation: such values get a leading single quote so spreadsheets show them as literal text. Numeric columns are generated internally and are untouched, and values not starting with one of those characters are written exactly as before, so existing CSV consumers see no change.

Before:

command,mean,...,parameter_payload
true,0,...,=1+1

After:

command,mean,...,parameter_payload
true,0,...,'=1+1

Verification (macOS, stable toolchain):

• cargo test — 45 + 19 + 39 passed, 0 failed
• cargo fmt --check — clean
• cargo clippy --all-targets -- -D warnings — identical to the master baseline (4 pre-existing errors in unrelated files from newer lints: redundant reference in format!/println!/bail!, deprecated cargo_bin); no new findings from this change
• Manual: hyperfine -w0 -r1 -L payload '=1+1,harmless' 'true' --export-csv - emits '=1+1 and leaves harmless unchanged

A regression test covering =, +, -, @ and a non-formula value is included in src/export/csv.rs.

---

Disclosure: this change was written with AI assistance (Claude). I have reviewed the diff, and run the tests, formatter and linter myself against a baseline.