fix: Task 3 review round 1 - strip control chars before the sanitizer (S32a), S34 minors

Control characters now go on the raw value in AttrWriter::cleanNode and
VariableRef::setting; after the sanitizer only rejection remains ('<' + VT/FF
no longer turns into a tag). VALUE_KEY anchored with D, exact column-width
fractions, nested rows in columns, specialty columns refused, fullwidth by
catalog category, preset ambiguity in DesignSystem::modulePresetId().

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/Compose/ShortformWriter.php

@@ -177,7 +177,9 @@ final class ShortformWriter
      */
     private function alt(string $module, string $path, string $alt, string $altKey): string
     {
-        if ($alt === '' || VariableRef::contains($alt)) {
+        // Controls are stripped at the choke point before its marker check (S32a) – so a
+        // NUL-split marker counts as a marker here too, and a canonical result is refused.
+        if ($alt === '' || VariableRef::contains(VariableRef::withoutControls($alt))) {
             return '';
         }
 
@@ -187,7 +189,7 @@ final class ShortformWriter
             return '';
         }
 
-        return is_string($clean) ? $clean : '';
+        return is_string($clean) && ! VariableRef::contains($clean) ? $clean : '';
     }
 
     /**