refactor: split VariableRef into ControlChars and DynamicContentRules (H2)

- ControlChars::strip()/stripDeep() (was VariableRef::withoutControls/Deep) with
  the S32/S32a/S35 docblock; callers AttrWriter, ShortformWriter, TextReplacer and
  the setting cleaner use it.
- DynamicContentRules (design system + dynamic content map): fieldsFor() (was
  contentFields: meta prefix -> map -> loop_ -> design names -> unknown),
  cleanSetting() (was setting(): raw strip -> raw marker -> field type ->
  final-string check -> meta key check, same order), one private method per
  field family (textSetting, selectPostSetting, scalarSetting), isMetaKey(),
  checkMap(), and the constants DEFAULT_DYNAMIC_CONTENT, META_SETTINGS,
  DESIGN_SETTINGS, META_KEY.
- VariableRef keeps the syntax: const END = ')$' replaces the six literals,
  payloadOf() is shared by typeOf() and canonical(); unknownName() is public for
  the rules. Error messages unchanged.
Tests unchanged apart from a class name in DynamicContentMapTest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/Divi/Compose/ControlChars.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Integrations\Divi\Compose;
+
+/**
+ * Removes C0 control characters except tab, LF and CR, and DEL (rulings S32/S32a). Applied to
+ * RAW values only, before the marker check and the sanitizer: the WordPress sanitizers keep them
+ * (sanitize_text_field keeps NUL; strip_tags reads "<" + VT/FF as a literal "<"), so a strip
+ * after sanitizing could build a marker or a tag no check saw. After the sanitizer a changed
+ * result of strip() only ever means rejection. Pure PHP.
+ */
+final class ControlChars
+{
+    public static function strip(string $value): string
+    {
+        return (string) preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $value);
+    }
+
+    /**
+     * strip() on every string inside $value (keys stay: odd keys are rejected). Ruling S35:
+     * AttrWriter::apply() and ShortformWriter::apply() run it once on their raw input, before
+     * placeholder resolution and trim – so "{\0{post:title}}" is the placeholder, checked as one,
+     * and never literal text that slipped past the placeholder check.
+     */
+    public static function stripDeep(mixed $value): mixed
+    {
+        if (is_string($value)) {
+            return self::strip($value);
+        }
+
+        return is_array($value) ? array_map([self::class, 'stripDeep'], $value) : $value;
+    }
+}