feat: Divi short-form writer

ShortformWriter routes every short-form string through AttrWriter::cleanValue()
with the curated field kind (new optional kind override), exposes the color
check for background_color and guards builder-only paths on removal too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/Divi/Compose/ComposeFixture.php

@@ -7,6 +7,7 @@ namespace LIT\MCP\Tests\Unit\Integrations\Divi\Compose;
 use LIT\MCP\Integrations\Divi\Compose\AttrWriter;
 use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
 use LIT\MCP\Integrations\Divi\Compose\Placeholders;
+use LIT\MCP\Integrations\Divi\Compose\ShortformWriter;
 use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
 use LIT\MCP\Tests\Unit\Integrations\Divi\Design\DesignSystemTest;
 use LIT\MCP\Tests\Unit\Integrations\Divi\Schema\ModuleCatalogTest;
@@ -57,9 +58,20 @@ final class ComposeFixture
                 return $value;
             }
 
+            /**
+             * Like esc_url_raw: spaces become %20, characters outside its allow list (tags, quotes,
+             * braces, NUL) go, %0d/%0a are removed repeatedly, javascript: gives ''.
+             */
             public function url(string $value): string
             {
-                return str_starts_with(strtolower(trim($value)), 'javascript:') ? '' : trim($value);
+                $value = str_replace(' ', '%20', trim($value));
+                $value = (string) preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\x80-\xff]|i', '', $value);
+                do {
+                    $before = $value;
+                    $value = str_replace(['%0d', '%0a', '%0D', '%0A'], '', $value);
+                } while ($value !== $before);
+
+                return str_starts_with(strtolower($value), 'javascript:') ? '' : $value;
             }
 
             public function allowsUnfilteredHtml(): bool
@@ -92,4 +104,13 @@ final class ComposeFixture
     {
         return new AttrWriter(ModuleCatalogTest::sampleCatalog(), self::placeholders(), self::sanitizer($unfiltered));
     }
+
+    /**
+     * @param array<string, array<string, array<string, mixed>>>|null $modules Short form per
+     *        type instead of ShortformMap (to reach paths the curated map never names).
+     */
+    public static function shortform(bool $unfiltered = false, ?array $modules = null): ShortformWriter
+    {
+        return new ShortformWriter(self::placeholders(), self::media(), self::attrWriter($unfiltered), $modules);
+    }
 }