Bump rand 0.8 → 0.10 and update all API usages

[svarlamov]

Summary

Upgrades the rand dev-dependency from 0.8 to 0.10 and migrates all test code to the new API surface. No production code changes — rand is only used in integration tests for generating random temp directory names and selecting random file subsets.

API migrations applied

rand 0.8	rand 0.10
rand::thread_rng()	rand::rng()
rand::Rng trait	rand::RngExt trait
.gen_range(range)	.random_range(range)
rand::distributions::Alphanumeric	rand::distr::Alphanumeric
rand::seq::SliceRandom	rand::seq::IndexedRandom
.choose_multiple(&mut rng, n)	.sample(&mut rng, n)

Files changed

• Cargo.toml / Cargo.lock: Version bump + dependency tree update (rand_chacha/ppv-lite86 replaced by chacha20)
• tests/integration/repos/test_repo.rs: 8 call sites updated (random temp dir names)
• tests/integration/performance.rs: Imports + 4 call sites (random file selection)
• tests/integration/checkpoint_size.rs: Import + 1 call site (random string generation)
• tests/integration/worktrees.rs: Import + 1 call site (unique worktree path)

Review & Testing Checklist for Human

• Verify .sample() (rand 0.10 IndexedRandom) is semantically equivalent to .choose_multiple() (rand 0.8 SliceRandom) — both should return n random elements without replacement
• Confirm CI passes on all three platforms (Ubuntu, macOS, Windows) since rand's RNG backend changed from ppv-lite86 to chacha20
• Spot-check that no test relies on deterministic RNG output (all usages appear to be for unique temp dir names / random subset selection, so this should be fine)

Notes

• rand 0.8.5 remains in Cargo.lock as a transitive dependency of phf_generator — this is expected and harmless.
• Supersedes chore(deps): bump rand from 0.8.5 to 0.10.1 #1087 which had the version bump but not the API migration fixes.

Link to Devin session: https://app.devin.ai/sessions/75f76db47e0247a08f64c032f757b9e6
Requested by: @svarlamov

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.