fix(network): source WebSocket masks from OS CSPRNG

[seonghobae]

Summary

• add fresh OS-CSPRNG masking keys for established WebDriver BiDi WebSocket text and Pong writes
• fail closed before any frame bytes when entropy is unavailable; diagnostics continue to redact key bytes
• retain injected keys solely for deterministic fixture-oriented APIs and prove live loopback frame writes use distinct masks

Traceability

• Advances [Product Gap] Complete the first real Chromium agent vertical slice #28; this does not close the broader browser-runtime gap.
• Stacked on fix(network): restore bounded WebSocket frame transport #243 at 97fab641ed9d76e6c515eadcef0629edfc8064a3.
• Documents RFC 6455 section 5.3 rationale in docs/doctoring.md; updates AGENTS.md, CLAUDE.md, and CHANGELOG.md.

Test-first evidence

• RED: cargo test -p originweave-network --test webdriver_bidi_websocket_masking_key_reuse established_stream_uses_os_random_masks_for_text_and_pong --locked failed before the random-mask write API existed.
• GREEN: cargo test -p originweave-network --locked (67 tests); cargo clippy -p originweave-network --all-targets --all-features -- -D warnings; RUSTDOCFLAGS='-D warnings' cargo doc -p originweave-network --no-deps --locked.
• Full workspace gate: cargo +nightly-2026-08-01 llvm-cov --locked --workspace --all-features --branch --json --summary-only --output-path coverage-final-three.json && python3 scripts/ci/verify_coverage.py coverage-final-three.json reported functions, lines, regions, and branches at 100%.

No release, deployment, browser integration, or merge is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 120c691d-c172-4052-b56a-ae5215fd2211

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}