[zhiaos]

Reverts #32. The rand 0.9 bump breaks cargo vendor, which is how WebGestaltR ships this
library to CRAN.

What was missed

#32 checked rand's own MSRV (1.63.0, matching what both manifests declare), its API surface
(one renamed function), and cargo test --all. All three passed. None of them exercises
vendoring.

cargo vendor fetches dependencies for every target, not just the host. rand 0.9 pulls
getrandom 0.3 → wasip2 → wit-bindgen 0.57.1, which requires Edition 2024:

$ cargo vendor
error: failed to sync
Caused by: failed to download `wit-bindgen v0.57.1`
Caused by: feature `edition2024` is required
  The package requires the Cargo feature called `edition2024`, but that feature is
  not stabilized in this version of Cargo (1.80.1)

Measured either side:

	cargo vendor	cargo test --all
rand 0.8.5	61 crates, clean	passes
rand 0.9.5	fails	passes

cargo test passes because the host target never compiles the wasm branch. That is what made
this look safe.

Why it matters here specifically

WebGestaltR vendors this crate into src/rust/vendor.tar.xz and ships that to CRAN, where
it is compiled offline on the user's machine. Edition 2024 needs cargo ≥ 1.85, while the
package declares Config/WebGestaltR/MSRV: 1.63.0. Vendoring on a newer toolchain is
possible, but the resulting tarball would then fail to build for anyone below 1.85 — the
declared MSRV would be untrue rather than merely conservative.

So master at #32 cannot produce a valid distribution tarball.

What this restores

Reverting also restores the permutation stream. #32 changed what a seed means — rand 0.9
reimplements SmallRng::seed_from_u64 and replaces shuffle — so with this revert, seeds
keep the meaning they had when seeding shipped in #31, and no golden regeneration or
NEWS.md caveat is needed.

Verified

cargo test --all passes (5 tests), and cargo vendor succeeds again from a clean
directory.

Before trying rand 0.9 again

Whoever revisits this should run cargo vendor as the acceptance test, not cargo build or
cargo test — vendoring is the distribution path and the only one that surfaces
target-specific transitive requirements. Reopening #29 with this recorded.