chore(deps): migrate system RNG to rand 0.10

[dependabot]

Summary

• migrate cryptographic salt and nonce generation from OsRng/RngCore to the rand 0.10 SysRng/TryRng API
• propagate operating-system entropy failures through MgeError::Crypto instead of relying on an infallible call
• enable only rand's sys_rng feature and refresh the lockfile

The serialized security metadata and encrypted-payload formats are unchanged.

Scope

• CLI
• Storage
• Retrieval
• Security
• Packaging
• Documentation

Safety checklist

• No silent fallback or fail-open behavior was introduced.
• Security-relevant errors are explicit and actionable.
• Existing persisted data remains compatible.
• No secrets, credentials, or private data are included.

Verification

• cargo fmt --check
• cargo check -p mge-cli --bins
• cargo check --workspace --all-targets
• cargo +1.95.0 check --locked --workspace --all-targets
• cargo test --locked --workspace --all-targets (219 tests)
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --manifest-path tools/agent-memory-eval/Cargo.toml (24 tests)
• cargo +1.98.0 clippy --manifest-path tools/agent-memory-eval/Cargo.toml --all-targets -- -D warnings

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.