refactor(base): simplify single-use class derivations

[LudoLoops]

Summary

Part of #594. Simplifies class computation for the Base Badge, Alert, and Card components by inlining their single-use cn(...) expressions in the root class attributes. Reactive variant/color updates, consumer classes, Skeleton presets, and markup remain unchanged. Adds render-and-rerender regression coverage and a svforge patch changeset.

Validation

• Targeted component/Skeleton tests: 50 passed.
• bun run lint, bun run typecheck, and bun run build:all: passed.
• bash scripts/test-scaffold.sh base: passed.
• Dashboard scaffold build/check passed; its Vitest run was blocked by 13 pre-existing rows in the configured test database (40 passed, 3 skipped, 2 failed due to that data).
• Full bun run test: 1,142 passed; 7 timed out and 3 workers failed to start under the full-suite run. The relevant component and Skeleton tests pass when run targeted.

This PR covers only the Base single-use class derivation family; the broader #594 audit remains open.

[LudoLoops]

Review completed — no merge blockers (head 092807ebc225f79082c5a927c5e2cab5e54b77cd).

This is a focused tranche of #594. The changes to primitives/Badge.svelte, ui/Alert.svelte, and ui/Card.svelte remove only single-use derived class expressions and move the equivalent cn(...) calls directly into each root class attribute. Their props, markup, Skeleton v5 utility/preset selection, consumer class merge behavior, and children/header/footer rendering remain unchanged. Svelte 5 updates expressions reactively; the new render/rerender tests explicitly verify updates for Badge variant/color, Alert variant, and Card variant.

Verified that all three packages/svforge/src/templates.ts mirror entries exactly match the canonical component sources. The patch Changeset and Graphify refresh are included. No custom CSS or new abstractions were introduced.

GitHub Actions CI #591 passed on this exact head: required quality job succeeded, including lint, typecheck, dependency audits, generated-manifest freshness, build-all, and the full test suite. The main-smoke job was skipped under the documented PR-only workflow condition. The reported local root-suite timeouts and populated Dashboard test-database failures did not recur in required CI; the PR's focused Base component tests and Base scaffold also passed.

No unresolved review threads; the broader audit #594 remains open for the remaining components.

MERGE DECISION: READY TO MERGE.