security(deps): lockfile bumps clearing open Cargo advisories (Track E) (#28)

## Lockfile-only security dependency fix (Track E, issue #16)

Same recipe as 007 #44 / docmatrix #35. **Cargo.toml untouched** — only
`Cargo.lock` is modified.

### Applied bumps

| Package | Old | New | Note |
|---|---|---|---|
| `rand` | 0.9.2 | 0.9.3 | clears live Dependabot/RUSTSEC advisory;
checksum verified against published crate (`7ec0956…87166`) |

The diff is the minimal 2-line version+checksum change for `rand`; its
resolved dependency tree (`rand_chacha`, `rand_core`) is unchanged
between 0.9.2 and 0.9.3.

### Deferred (NOT in this PR — need separate reviewed work)

- `gix` / `gix-fs` / `gix-pack` / `gix-transport` advisories require a
**breaking parent bump** (`gix 0.79 -> 0.83`). That is **not
lockfile-only** and is left for a dedicated reviewed PR.

### Out of scope

- Residual RUSTSEC **unmaintained-crate** advisories are not
vulnerabilities and are out of scope for this lockfile-only pass.

Signed (ssh key `kVP7Nb…`). **Manual review — no auto-merge.**

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath