MooseMaterialTarget app_name flows unescaped/unvalidated into the registerMooseObject string literal #143

From the 2026-08-02 full-repo review (finding F-17).

Evidence: src/targets/moose_material.cpp:353 — os << "registerMooseObject(\"" << app_name << "\", ...) with neither escape_for_cpp_literal (defined in the same file at line 101 and correctly applied to p.doc at 380 and i.role.name at 384) nor construction-time validation. This is the same class the model name was hardened against (recipe.h:311-325, whose comment explicitly calls it a malformed-output/injection vector).

Impact: a " or \ in app_name yields malformed generated C++ (loud failure today), but targets/target_factory.h:22-25 anticipates threading app_name from config/CLI, where hostile/accidental input becomes realistic.

Fix: validate app_name at construction (identifier-ish, matching the model-name precedent) or escape_for_cpp_literal at the call site; unit test with a hostile app_name.