fix(core): address PR feedback — ReDoS-safe slug trim, getVariables cleanups

- slugify: replace the anchored alternated trim regex (/^-+|-+$/g) with a
  character-scan trim — CodeQL js/polynomial-redos blocker.
- readRenderOverrides: fold the readOverrides wrapper into the exported
  function (one name, no pass-through).
- getVariables: deduplicate declarers with a Set, matching
  injectCompositionCssVariables.
- Move the tokenSlug import to the top of the file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core/src/tokenSlug.ts

@@ -8,10 +8,15 @@
  */
 
 export function slugify(name: string): string {
-  const slug = name
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+  const collapsed = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+  // Character-scan trim of leading/trailing "-" instead of /^-+|-+$/:
+  // CodeQL flags the alternated anchored regex as polynomial ReDoS on
+  // adversarial inputs (js/polynomial-redos).
+  let start = 0;
+  let end = collapsed.length;
+  while (start < end && collapsed[start] === "-") start++;
+  while (end > start && collapsed[end - 1] === "-") end--;
+  const slug = collapsed.slice(start, end);
   return slug.length > 0 ? slug : "node";
 }