fix(network): source WebSocket client keys from OS CSPRNG

[seonghobae]

Summary

• add an OS-CSPRNG constructor for fresh RFC 6455 Sec-WebSocket-Key nonces
• keep canonical caller-provided key construction only for deterministic fixture-oriented use
• prove canonical base64 encoding, diagnostic redaction, and entropy failure propagation

Traceability

• Advances [Product Gap] Complete the first real Chromium agent vertical slice #28; this does not close the controlled Chromium vertical slice.
• Stacked on fix(network): source WebSocket masks from OS CSPRNG #303 exact 36e8743beb3e8b3e36dd48df131e0bb7bcc13038, which in turn is stacked on fix(network): restore bounded WebSocket frame transport #243.
• Documents RFC 6455 sections 4.1 and 5.3 in docs/doctoring.md; updates AGENTS.md, CLAUDE.md, and CHANGELOG.md.

Test-first evidence

• RED: cargo test -p originweave-network random_client_key_is_canonical_redacted_and_propagates_entropy_failure --locked failed because no random client-key API existed.
• GREEN: cargo test -p originweave-network --locked (68 tests); cargo clippy -p originweave-network --all-targets --all-features -- -D warnings; RUSTDOCFLAGS='-D warnings' cargo doc -p originweave-network --no-deps --locked.
• Full workspace gate: cargo +nightly-2026-08-01 llvm-cov --locked --workspace --all-features --branch --json --summary-only --output-path coverage-handshake-csprng.json && python3 scripts/ci/verify_coverage.py coverage-handshake-csprng.json reported functions, lines, regions, and branches at 100%.

No release, deployment, browser integration, or merge is claimed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e5e0ad20-df03-4069-8505-acfa3324b61a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack maintenance evidence: after #303 merged into #243 as f15b4ae57c4f45c1b3e217dca8f7e73dd136b397, this PR was retargeted from the former #303 source branch to #243. A fresh tree comparison confirms #243 head f15b4ae… has the same tree as #303 exact source 36e8743beb3e8b3e36dd48df131e0bb7bcc13038; the current #304 head therefore produces the same merge tree as before retargeting. The existing exact-head CI run remains queued and was not restarted without a changed code tree. Merge still requires that run to finish successfully.