fix(schema): rewrite sanitize_molecular_formula() with element-grammar (Option B)

Replace character-allowlist regex with an element-token grammar validator.
Strip control characters first, then extract the maximal leading run of
valid element tokens ([A-Z][a-z]?\d*) and group separators (()[]·.).

Fixes: 'C10H12\ninjection' now returns 'C10H12' (was 'C10H12injection').
New:   fully invalid inputs (e.g. '<script>alert(1)</script>') return ''.
Keep:  parenthesised formulas (e.g. 'C2H5(OH)') pass unchanged.

Unit tests expanded from 4 to 7 formula cases covering all five DoD
requirements plus whitespace-only edge case.

PHP not installable in sandbox; all 7 test inputs hand-traced
against the regex and confirmed correct via Python simulation.

Agent-Session: peptide-schema-backfill v0.6.0 formula-validator

tests/unit/test-migration-0004.php

@@ -168,6 +168,12 @@ $single = json_decode( $migration->parse_aliases_string( 'Only One' ), true );
 pr_assert_equals( 1, count( $single ), 'single alias produces array of 1' );
 
 // ── sanitize_formula() ───────────────────────────────────────────────────
+// Five required cases (Option B — validate, don't allowlist):
+//   1. Valid formula unchanged.
+//   2. Parenthesised formula preserved.
+//   3. Newline-injected payload — "injection" stripped, formula kept.
+//   4. Fully invalid string (script tag contents) → empty.
+//   5. Empty / whitespace-only → empty.
 
 echo "\nPR_Core_Schema_Sanitizers::sanitize_molecular_formula():\n";
 
@@ -183,10 +189,22 @@ pr_assert_equals(
 	'HTML tags stripped from formula'
 );
 
+pr_assert_equals(
+	'C2H5(OH)',
+	PR_Core_Schema_Sanitizers::sanitize_molecular_formula( 'C2H5(OH)' ),
+	'parenthesised formula preserved unchanged'
+);
+
 pr_assert_equals(
 	'C10H12',
 	PR_Core_Schema_Sanitizers::sanitize_molecular_formula( "C10H12\ninjection" ),
-	'non-formula characters removed'
+	'non-formula characters removed — newline+word stripped, formula kept'
+);
+
+pr_assert_equals(
+	'',
+	PR_Core_Schema_Sanitizers::sanitize_molecular_formula( '<script>alert(1)</script>' ),
+	'fully invalid string returns empty string'
 );
 
 pr_assert_equals(
@@ -195,6 +213,12 @@ pr_assert_equals(
 	'empty string returns empty string'
 );
 
+pr_assert_equals(
+	'',
+	PR_Core_Schema_Sanitizers::sanitize_molecular_formula( '   ' ),
+	'whitespace-only returns empty string'
+);
+
 // ── Idempotency: skips when all three PR Core keys populated ─────────────
 
 echo "\nIdempotency (all _pr_* keys populated):\n";