[wieslawsoltes]

Problem and resulting behavior

WebScene's V8 bootstrap implemented crypto.getRandomValues() with Math.random(), filled only 8 bits per array element, accepted floating-point views and oversized requests, and omitted crypto.randomUUID(). Unchanged VS Code OSS 1.137 reaches secure random in its browser workbench and worker extension host for UUIDs, authentication nonces/verifiers, WebSocket keys/masks, and built-in extension identifiers.

This change replaces that path with one native operating-system CSPRNG service:

• Apple/BSD: bounded getentropy() calls;
• Linux: getrandom() with interruption handling;
• Windows: BCryptGenRandom() with the system-preferred provider.

getRandomValues() now fills the view's exact byte range, accepts only integer TypedArrays, enforces the 65,536-byte quota before mutation, returns its argument by identity, and preserves Crypto receiver checks. randomUUID() emits canonical RFC 4122 version 4 UUIDs from the same native source. The binding is installed consistently in window, hydrated iframe, and dedicated-worker realms.

There is no PRNG fallback. crypto.subtle remains absent because WebScene does not yet have a vetted cross-platform provider and complete CryptoKey semantics; that work is scoped separately in #102. The VS Code call inventory and this boundary are documented in docs/code-oss-compatibility.md.

Closes #101.

Validation

• Release V8 build: webscene_hybrid_v8_runtime_tests compiled and passed on macOS ARM64.
• Native CSPRNG security/performance gate: passed on macOS ARM64 (0.01 s), Ubuntu 24.04 ARM64 (-Wall -Wextra -Werror), and Windows 11 ARM64/MSVC (0.60 s).
• Focused native CTest: 2/2 (webscene_secure_random_tests, webscene_hybrid_v8_runtime_tests).
• Focused native WPT-style contract: 1/1 document, 23/23 subtests, 758 ms.
• Architecture tests: 29/29.
• Test coverage includes every integer TypedArray family, float/DataView/type rejection, exact and exceeded quota, non-mutation on quota failure, byte-offset bounds, empty views, receiver errors, UUID version/variant shape, repeated values, and window/iframe/worker parity.

The 4,096-call performance gate has a two-second budget to reject per-byte syscall regressions while allowing normal hosted-runner variance.