Remove transparent getrandom backend — paired with astrid#767

[joshuajbouw]

Background

astrid-sys ships a transparent __getrandom_v03_custom backend that routes getrandom calls to astrid:sys/host.random-bytes. Activated via #[cfg(all(target_arch = "wasm32", getrandom_backend = "custom"))]. Capsules set the rustflag in their .cargo/config.toml.

This means a capsule calling Uuid::new_v4(), or pulling any library that does OsRng.fill_bytes(...), lands in the kernel host fn silently. Entropy IS audited and principal-scoped — but it's invisible at the capsule call site. Reviewers can't grep for "this capsule uses randomness" without walking the transitive dep tree.

Desired end state (paired with unicity-astrid/astrid#767)

Every entropy use becomes an explicit visible kernel call:

let bytes = astrid_sdk::runtime::random_bytes(16)?;
let id = Uuid::from_bytes(bytes.try_into().unwrap());

Removing the transparent backend means any code path that tries to pull getrandom fails at compile time on wasm32-unknown-unknown. Capsule authors hit a clear compile error, fix it with the explicit call, and the audit query becomes git grep 'runtime::random_bytes'.

Same principle as "no wasi:* in the linker" — visibility at the WIT line, no transparent fallbacks.

What needs to change in sdk-rust

1. astrid-sys/src/lib.rs: drop the __getrandom_v03_custom block.
2. astrid-sys/Cargo.toml: drop the getrandom dep + the rationale comment.
3. astrid-sys/build.rs: drop the rustc-check-cfg=cfg(getrandom_backend, ...) declaration.
4. astrid-sdk/src/ipc.rs: request_response builds a v4-shaped UUID from Uuid::new_v4() — line 206. Switch to runtime::random_bytes(16) + Uuid::from_bytes.
5. astrid-sdk/Cargo.toml: uuid features drop v4 + rng-getrandom, keep just serde.
6. All capsule .cargo/config.toml files: drop the --cfg=getrandom_backend="custom" rustflag.
7. All capsule Cargo.toml files: drop v4 + rng-getrandom from uuid features where present.
8. Capsules calling Uuid::new_v4() directly (audit: capsule-session/src/lib.rs:345, capsule-react/src/lib.rs:377): switch to runtime::random_bytes-built UUIDs.

Blocker

This can't land without unicity-astrid/astrid#767 first. astrid-types 0.7.0 on crates.io has uuid = { features = ["v4", "rng-getrandom"] } baked into its published manifest — getrandom enters the build graph through there regardless of what astrid-sdk declares. Cargo features are additive; sdk-rust can't subtract.

Sequence: astrid-types 0.7.1 publishes with the minimal uuid features → then sdk-rust drops the transparent backend → capsules cascade.

Deferred

For 0.7.x: keep the transparent backend. Capsule code keeps using Uuid::new_v4(). Known trade-off; entropy is still audited, just not visible at call sites.

For 0.8.x / next breaking line: land this as a hard line.

[AjinSaputraa]

Finkk bug