fix(csv): strip leading byte-order mark in CsvParseStream

[LeSingh1]

The synchronous parse() function already strips a leading UTF-8
byte-order mark (U+FEFF) from its input, but CsvParseStream did not.

When a CSV file begins with a BOM -- common output from Excel and other
Windows tools -- the first field name arrives as "name" instead
of "name". That corrupts header-based lookups silently:

const source = ReadableStream.from(["name,age\n", "Alice,34\n"]);
const records = await Array.fromAsync(
  source.pipeThrough(new CsvParseStream({ skipFirstRow: true })),
);
// before this fix:
// [{ "name": "Alice", age: "34" }]   -- BOM leaks into key
// after:
// [{ name: "Alice", age: "34" }]

The fix adds a #firstLine flag to StreamLineReader and strips the
BOM from the first line it reads, exactly matching what parse() does
via its BYTE_ORDER_MARK constant.

Two new tests cover the regression: one for plain string[][] output and
one for skipFirstRow: true (object output, where the BOM corrupts the
header key).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.57%. Comparing base (cdf74a8) to head (9e34775).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7183      +/-   ##
==========================================
- Coverage   94.57%   94.57%   -0.01%     
==========================================
  Files         636      637       +1     
  Lines       52142    52159      +17     
  Branches     9401     9403       +2     
==========================================
+ Hits        49315    49328      +13     
- Misses       2249     2254       +5     
+ Partials      578      577       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bartlomieju]

Nice catch — this is a real correctness bug, and putting the strip in StreamLineReader.readLine() is the right place since line-splitting happens upstream, so the BOM is always the first char of the first line. Tests pass locally and the scope (first line only) matches parse().

One consistency nit inline: every other spot in csv/ defines this as "\ufeff" rather than the raw glyph. Worth aligning so the source stays free of invisible characters.

[bartlomieju]

Prefer the escape sequence "\ufeff" over the literal BOM glyph here. Every other definition in csv/ uses it — parse.ts:16, stringify.ts:128, parse_test.ts:11, stringify_test.ts:16 — and a raw, invisible U+FEFF in source is unreviewable and copy-paste-hostile.

Suggested change

	const BYTE_ORDER_MARK = "";
	const BYTE_ORDER_MARK = "\ufeff";

[bartlomieju]

Same here — use "\ufeff" instead of the literal glyph, and consider naming it BYTE_ORDER_MARK to match the convention used in parse_test.ts / stringify_test.ts.

Suggested change

	const BOM = "";
	const BOM = "\ufeff";

[bartlomieju]

Same "\ufeff" suggestion as above.

Suggested change

	const BOM = "";
	const BOM = "\ufeff";