fix: anchored input patterns end at the last character (/D)

Without /D, "$" also matches before a trailing "\n", so "custom_meta_telefon\n",
a color setting "5\n" (stored as sent) or a whole reference followed by "\n"
passed VariableRef. Added /D to every ^...$ pattern that validates client or
admin input:
- VariableRef META_KEY, NUMBER, WHOLE (canonical/typeOf; Placeholders::field
  shares META_KEY)
- Cursor::decode, GuideRepository topic names (MCP input and filter keys)
- ExposurePolicy::sanitize ability keys and group ids, LogTab list filters

Not changed: Placeholders::PATTERN (runs on trim()), Warnings hex checks (hints
only), NodeSummary/AttrPathIndex/LogListTable (stored or Divi data, no client
input). Each fixed pattern has a test with a trailing "\n" that is rejected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Admin/LogTabTest.php

@@ -63,6 +63,22 @@ final class LogTabTest extends TestCase
         self::assertSame(['result' => '', 'date_from' => '', 'date_to' => '2026-13-99'], $tab->extraFilters());
     }
 
+    /**
+     * "$" without /D also matches before a trailing newline. sanitize_text_field() already drops
+     * it in WordPress; the whitelist must hold on its own, so the sanitizer passes it through here.
+     */
+    public function testFiltersRejectATrailingNewlineEvenWithoutTheSanitizer(): void
+    {
+        Functions\when('sanitize_text_field')->returnArg();
+        $tab = new LogTab(Mockery::mock(ChangeLog::class), new Limits());
+        $_GET['ability'] = "lit/content-update\n";
+        $_GET['date_from'] = "2026-09-01\n";
+        $_GET['date_to'] = "2026-09-25\n";
+
+        self::assertSame('', $tab->filters()['ability']);
+        self::assertSame(['result' => '', 'date_from' => '', 'date_to' => ''], $tab->extraFilters());
+    }
+
     public function testClearNeedsNonceAndRights(): void
     {
         Functions\stubTranslationFunctions();