refactor(core,cli,engine): apply /simplify findings on getVariables PR

- core/runtime/getVariables.ts: collapse the noisy three-step type-guard
  re-cast into a single `Record<string, unknown>` narrow with early-continue
  guards. Same behaviour, ~6 lines shorter.
- cli/commands/render.ts: separate VariablesParseError from UI strings.
  parseVariablesArg now returns a kind-discriminated error
  (`conflict | read-error | parse-error | shape-error`) and the wrapper
  resolveVariablesArg owns the title/message mapping via
  `variablesErrorMessage`. Keeps the parser pure of presentation strings.
- cli/commands/render.test.ts: lift the `await import("./render.js")` into
  a `beforeAll`, add a typed `expectErr` helper, assert on the structured
  error kind instead of message-string regexes. Same coverage, less noise.
- engine/services/frameCapture.ts: replace the `as unknown as { ... }`
  double-cast with a single named `WindowWithVariables` alias inside the
  page closure.

All affected suites green (core getVariables 9, cli render 12, cli
dockerRunArgs 13).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/engine/src/services/frameCapture.ts

@@ -162,9 +162,9 @@ export async function createCaptureSession(
   if (options.variables && Object.keys(options.variables).length > 0) {
     const variablesJson = JSON.stringify(options.variables);
     await page.evaluateOnNewDocument((json: string) => {
+      type WindowWithVariables = Window & { __hfVariables?: Record<string, unknown> };
       try {
-        (window as unknown as { __hfVariables?: Record<string, unknown> }).__hfVariables =
-          JSON.parse(json);
+        (window as WindowWithVariables).__hfVariables = JSON.parse(json);
       } catch {
         // The CLI validated the JSON before this point — a parse failure here
         // means the page swapped JSON.parse, which is the page's problem.