chore(deps): bump rand 0.8→0.10 and russh 0.52→0.60

Updates rand to 0.10.0 and russh to 0.60.0 with API migration and cargo-vet exemptions for new transitive dependencies.

Author: dependabot[bot]

Cargo.toml

@@ -67,7 +67,7 @@ sha2 = "0.11"
 
 # Ed25519 signing (bot-auth request signing)
 ed25519-dalek = { version = "2", features = ["rand_core"] }
-rand = "0.8"
+rand = "0.10"
 
 # CLI
 clap = { version = "4", features = ["derive"] }
@@ -92,7 +92,7 @@ tracing = "0.1"
 tower = { version = "0.5", features = ["util"] }
 
 # SSH client (for ssh/scp/sftp builtins)
-russh = "0.52"
+russh = "0.60"
 russh-keys = "0.49"
 
 # Serial test execution

crates/bashkit/src/network/bot_auth.rs

@@ -20,7 +20,7 @@
 
 use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 use ed25519_dalek::{Signer, SigningKey, VerifyingKey};
-use rand::RngCore;
+use rand::Rng;
 use sha2::{Digest, Sha256};
 use std::time::{SystemTime, UNIX_EPOCH};
 
@@ -183,7 +183,7 @@ fn jwk_thumbprint_ed25519(key: &VerifyingKey) -> String {
 /// Generate a cryptographically random nonce (32 bytes, base64url-encoded).
 fn generate_nonce() -> String {
     let mut bytes = [0u8; 32];
-    rand::thread_rng().fill_bytes(&mut bytes);
+    rand::rng().fill_bytes(&mut bytes);
     URL_SAFE_NO_PAD.encode(bytes)
 }