“Data filtering as a standalone procedure is insufficient to mitigate the dual-use risks of open-weight bio-foundation models.”