fix: Task 1 review round 3 - re-check $variable marker after sanitizing, meta-key rule

Critical-1/S28: sanitizers that strip <x>, NUL or %XX could rebuild the
$variable( marker after the raw check; every cleaned string (AttrWriter
at every depth, VariableRef settings) is checked again. S29: custom_meta_
map names and *meta_key setting values obey META_KEY. Minor-2: malformed
dynamic content maps fail with InvalidArgumentException.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Unit/Integrations/Divi/Compose/ComposeFixture.php

@@ -25,15 +25,31 @@ final class ComposeFixture
             {
             }
 
+            /** Like sanitize_text_field: NUL bytes, tags and %XX octets go, then trim. */
             public function text(string $value): string
             {
-                return trim(strip_tags($value));
+                $value = strip_tags(str_replace(chr(0), '', $value));
+
+                return trim((string) preg_replace('/%[a-f0-9]{2}/i', '', $value));
             }
 
-            /** Like WpValueSanitizer (ruling S4): raw for users with unfiltered_html. */
+            /**
+             * Like WpValueSanitizer (ruling S4): raw for users with unfiltered_html; otherwise like
+             * wp_kses_post: NUL bytes, <script> blocks and tags outside a small allow list go.
+             */
             public function html(string $value): string
             {
-                return $this->unfiltered ? $value : (string) preg_replace('#<script\b[^>]*>.*?</script>#is', '', $value);
+                if ($this->unfiltered) {
+                    return $value;
+                }
+
+                $value = (string) preg_replace('#<script\b[^>]*>.*?</script>#is', '', str_replace(chr(0), '', $value));
+
+                return (string) preg_replace(
+                    '#</?(?!(?:p|b|i|em|strong|a|br|span|h[1-6]|ul|ol|li)\b)[a-z][^>]*>#i',
+                    '',
+                    $value
+                );
             }
 
             public function code(string $value): string