Function write_form_csvs 

pub fn write_form_csvs(
    out_dir: &Path,
    state: &LedgerState,
    year: i32,
    se_result: Option<&SeTaxResult>,
    donation_details: &BTreeMap<EventId, DonationDetails>,
) -> Result<(), CliError>

Write the four year-scoped form CSVs for year into out_dir.

Creates out_dir owner-only (0o700) if absent (tolerant mkdir_owner_only, mkdir-p); each CSV is written via fsperms::open_owner_only (0o600). Only form8949.csv, schedule_d.csv, form8283.csv, and — when se_result is Some — schedule_se.csv are written. The all-years dump CSVs (lots.csv, disposals.csv, removals.csv, income.csv) are NOT written; export_snapshot / snapshot.sqlite are NEVER called or written.

Path containment is the CALLER’s job (matching write_csv_exports / export_snapshot / backup_key): callers must pass a freshly-created or trusted directory — this function truncates the four fixed filenames in out_dir (open_owner_only is create-or-truncate and follows symlinks). The TUI’s export.rs satisfies this via mkdir_owner_only_exclusive (D2).