Harden log export CSV and fix profile loader boundary

Load SCIM profile emails via Identities in the export
layer, drop the cross-table join, sanitize formula-leading
cells, and fall back to validated userName when profile email
is missing. Drop redundant gid array casts in LoadByIDs.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/coredata/identity.go

@@ -407,7 +407,7 @@ SELECT
 FROM
     identities
 WHERE
-    id = ANY(@identity_ids::text[])
+    id = ANY(@identity_ids)
 `
 
 	args := pgx.StrictNamedArgs{"identity_ids": identityIDs}

pkg/coredata/membership_profile.go

@@ -507,7 +507,7 @@ SELECT
     p.id,
     p.identity_id,
     p.organization_id,
-    i.email_address,
+    ''::citext AS email_address,
     p.source,
     p.state,
     p.full_name,
@@ -540,8 +540,6 @@ SELECT
     p.updated_at
 FROM
     iam_membership_profiles p
-INNER JOIN identities i
-    ON i.id = p.identity_id
 WHERE
     p.%s
     AND p.organization_id = @organization_id

pkg/coredata/personal_api_key.go

@@ -320,7 +320,7 @@ SELECT
 FROM
     iam_personal_api_keys
 WHERE
-    id = ANY(@api_key_ids::text[])
+    id = ANY(@api_key_ids)
 `
 
 	args := pgx.StrictNamedArgs{"api_key_ids": apiKeyIDs}