perf(utils): single-buffer ID() + shortRand — 5 allocs → 1

ID() built its 30-char output by chaining four allocating helpers:
Concat → FormatUint → RandomBytes → HexEncode, each allocating an
intermediate string that was discarded by the next stage.

Rewrite: build into a single 32-byte slice via strconv.AppendUint +
hex.AppendEncode, hand to AsString for the zero-copy return. Same
crypto-random entropy source (cryptorand.Read into a 3-byte stack
buffer) so the security shape is unchanged.

shortRand() same pattern — one alloc instead of two.

Bench impact (Apple M3 Ultra):
  Utils_ID   128.8 ns / 64 B / 5 allocs → 72.89 ns / 32 B / 1 alloc
             1.8x faster, 80% alloc reduction

Author: Snider

utils.go

@@ -5,6 +5,12 @@
 
 package core
 
+import (
+	cryptorand "crypto/rand"
+	"encoding/hex"
+	"strconv"
+)
+
 // --- ID Generation ---
 
 var idCounter AtomicUint64
@@ -14,16 +20,37 @@ var idCounter AtomicUint64
 //
 //	id := core.ID()  // "id-1-a3f2b1"
 //	id2 := core.ID() // "id-2-c7e4d9"
+//
+// Implementation: builds into a single pre-sized []byte then handed to
+// AsString — one heap allocation total even when the prefix + counter
+// + hex suffix would otherwise each cost a string. Previously cost 5
+// allocs through Concat / FormatUint / RandomBytes / HexEncode / final.
 func ID() string {
-	return Concat("id-", FormatUint(idCounter.Add(1), 10), "-", shortRand())
+	// "id-" + uint64 (max 20 digits) + "-" + 6 hex chars = 30 cap.
+	buf := make([]byte, 0, 32)
+	buf = append(buf, "id-"...)
+	buf = strconv.AppendUint(buf, idCounter.Add(1), 10)
+	buf = append(buf, '-')
+
+	var rnd [3]byte
+	if _, err := cryptorand.Read(rnd[:]); err != nil {
+		buf = append(buf, "000000"...)
+	} else {
+		buf = hex.AppendEncode(buf, rnd[:])
+	}
+	return AsString(buf)
 }
 
+// shortRand returns 6 hex characters of crypto-random data, or "000000"
+// on entropy failure. Used by Fs.WriteAtomic to suffix temp filenames.
 func shortRand() string {
-	r := RandomBytes(3)
-	if !r.OK {
+	buf := make([]byte, 0, 6)
+	var rnd [3]byte
+	if _, err := cryptorand.Read(rnd[:]); err != nil {
 		return "000000"
 	}
-	return HexEncode(r.Value.([]byte))
+	buf = hex.AppendEncode(buf, rnd[:])
+	return AsString(buf)
 }
 
 // --- Validation ---