Replace character-allowlist regex with an element-token grammar validator.
Strip control characters first, then extract the maximal leading run of
valid element tokens ([A-Z][a-z]?\d*) and group separators (()[]·.).
Fixes: 'C10H12\ninjection' now returns 'C10H12' (was 'C10H12injection').
New: fully invalid inputs (e.g. '<script>alert(1)</script>') return ''.
Keep: parenthesised formulas (e.g. 'C2H5(OH)') pass unchanged.
Unit tests expanded from 4 to 7 formula cases covering all five DoD
requirements plus whitespace-only edge case.
PHP not installable in sandbox; all 7 test inputs hand-traced
against the regex and confirmed correct via Python simulation.
Agent-Session: peptide-schema-backfill v0.6.0 formula-validator
817690c1b6