Phase 7a Sanitizer clean-room (no ProcessWire residue)

[bigin]

First sub-phase of the field-type-system rewrite. The Sanitizer is the foundation 7b and 7c will lean on, so it lands first and small.

Why a clean-room rewrite

The 1.x Sanitizer carried roughly a dozen unported $this->wire(...) calls inherited from a ProcessWire ancestor — see docs/imanager-analysis.md §4.3. The wire() method doesn't exist on iManager, so any of those code paths that fired would Fatal at runtime. Substantial parts of the file were latent-broken rather than truly working.

Rather than port-fix each one, this PR ships a fresh Imanager\Validation\Sanitizer from scratch with only the methods the upcoming field-type plugins (7b / 7c) actually need.

Public API

Method	Purpose
text(string, int = 255)	Single-line: strip control chars, collapse whitespace, trim, truncate by Unicode codepoint count
multiline(string, int = 65535)	Preserve newlines, normalize CRLF / CR → LF
slug(string, int = 128)	URL-safe identifier with iconv ASCII transliteration
identifier(string, int = 30)	PHP-style [A-Za-z_][A-Za-z0-9_]*; prepends _ if it would otherwise start with a digit
filename(string, int = 128)	basename() + explicit / and \\ stripping (defense-in-depth against cross-platform path-separator smuggling)
email(string)	Returns the validated address, or null
url(string)	Returns the validated http/https URL, or null
int(mixed, ?int min, ?int max)	Coerce + optional clamp
float(mixed, ?float min, ?float max)	Coerce + optional clamp
bool(mixed)	FILTER_VALIDATE_BOOLEAN; non-truthy / non-falsy → false
entities(string)	htmlspecialchars(ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5)
markdown(string)	Parsedown in safe mode (raw HTML escaped)
html(string)	HTMLPurifier with conservative tag allowlist

Parsedown and HTMLPurifier are lazy-instantiated and overridable via constructor injection — the Sanitizer is cheap to wire into the container even when only the lightweight string methods are exercised.

Acceptance criteria (Phase 7a slice of plan §7 Phase 7)

• Imanager\Validation\Sanitizer exists at the location the plan placed it
• Zero references to wire() or any other ProcessWire artifact
• Real Composer dependencies for Markdown (erusev/parsedown) and HTML purification (ezyang/htmlpurifier)
• Method coverage sufficient for the 17 built-in field types coming in 7b/7c

Verification

Check	Result
PHP-CS-Fixer	0 issues
PHPStan level 8	no errors
Psalm level 3	no errors, 99.34% type inference
PHPUnit	324 tests, 644 assertions (266 from Phase 6 + 58 new)

Notes

• HTMLPurifier's on-disk cache is disabled (Cache.DefinitionImpl = null) so we don't surprise anyone with a write into a directory the framework's host owner doesn't expect. Performance hit on first call is acceptable; if it bites later, we'll wire a configurable cache path through the container.
• entities() emits ' for the single quote (HTML5-flag behavior). The 1.x Sanitizer would have emitted ' (HTML4 default). Templates that scrape sanitizer output looking for ' will need to be updated — but no production templates today depend on this, so we take the cleaner default.
• slug() uses iconv('UTF-8', 'ASCII//TRANSLIT//IGNORE', ...). Transliteration coverage varies across libcs (glibc, musl, BSD); the test that exercises the path with naïve résumé only asserts the result is slug-shaped (/^[a-z0-9-]+$/), not its exact bytes. If we ever need deterministic transliteration we'll switch to intl's Transliterator, but that requires
  ext-intl which isn't in composer.json today.
• The 1.x Sanitizer also exposed a purify() method that just delegated to wire('modules')->get('MarkupHTMLPurifier') — it's intentionally not preserved under the same name. The new equivalent is html().