rand 0.9 upgrade is blocked: it breaks cargo vendor (edition2024)

[zhiaos]

Tracking the rand 0.8 → 0.9 upgrade, which is currently blocked. Replaces #29, whose
Dependabot branch has been deleted so it cannot be reopened.

Attempted in #32 and reverted in #33.

The blocker

cargo vendor fetches dependencies for every target, not just the host. rand 0.9 pulls
getrandom 0.3 → wasip2 → wit-bindgen 0.57.1, which requires Edition 2024:

$ cargo vendor
error: failed to sync
Caused by: failed to download `wit-bindgen v0.57.1`
Caused by: feature `edition2024` is required
  The package requires the Cargo feature called `edition2024`, but that feature is
  not stabilized in this version of Cargo (1.80.1)

	cargo vendor	cargo test --all
rand 0.8.5	61 crates, clean	passes
rand 0.9.5	fails	passes

Edition 2024 needs cargo ≥ 1.85; WebGestaltR declares Config/WebGestaltR/MSRV: 1.63.0.

This matters because vendoring is not a convenience here — WebGestaltR ships this crate
inside src/rust/vendor.tar.xz and CRAN compiles it offline on the user's machine. Vendoring
on a newer toolchain is possible, but the resulting tarball would then fail for anyone below
cargo 1.85, making the declared MSRV untrue rather than merely conservative.

Use cargo vendor as the acceptance test, not cargo build or cargo test. The host
target never compiles the wasm branch, which is exactly why #32 looked safe: its tests passed.

Second thing to know: 0.9 changes what a seed means

rand 0.9 lists both of the APIs this crate uses under Reproducibility-breaking changes —
it reimplements SmallRng::seed_from_u64 (#1203) and replaces the SliceRandom::shuffle
algorithm (#1272). Measured with make_permutations(3, 20, Some(42)):

	first permutation
rand 0.8.5	[16, 2, 5, 14, 1, 12, 11, 19, 17, 15]
rand 0.9.5	[16, 17, 19, 6, 9, 5, 18, 8, 10, 11]

Since #31 added a seed parameter so GSEA results reproduce, this is a user-visible break:
a seed quoted in a methods section stops reproducing across the version boundary.

That break is cheapest right now. Seeding is not yet in a released WebGestaltR, so no
published seed depends on the current stream. Whoever unblocks the vendoring problem should
take the seed break in the same release.

Also not viable: rand 0.10

Requires Edition 2024 and MSRV 1.85 in its own right, and removes from_os_rng again.

What would unblock this

• getrandom/wasip2 resolving without an Edition 2024 crate in the graph, or
• a deliberate decision to raise the package MSRV to ≥ 1.85, which affects every downstream
  R and Python user, or
• a way to vendor without wasm targets in the graph