security(deps): lockfile bumps clearing open Cargo advisories (Track E)

[hyperpolymath]

Lockfile-only security dependency fix (Track E, issue #69). Same recipe as 007 #44 / docmatrix #35.

Applied bumps

Package	From	To
rand	0.9.2	0.9.3

(Transitive: windows-sys v0.59.0 dropped as a normal lockfile consequence. The separate rand 0.8.6 tree is a different major and was left untouched.)

Scope notes

• Cargo.lock only — Cargo.toml untouched, no version-constraint edits, no breaking/major bumps.
• Residual RUSTSEC unmaintained-crate advisories are not vulnerabilities and are out of scope.
• No deferred fixes for this run.

Signed (ssh, key kVP7Nb). Manual review, no auto-merge.