proto: grinding-resistant randomness beacon

## Goal
The models assume randomness an adversary cannot grind. In the prototype that's the epoch nonce — a config value today, fine for experiments; a real network needs an unbiasable source.

## Outcome
A beacon design and security argument (deployment integration is out of phase-2 scope).

## Needed
- [ ] Candidate sources (block hash, VRF) + grinding analysis
- [ ] Security argument
- [ ] Confirm `Event::Epoch { nonce }` is the only seam needed

## References
`pubsub-node/docs/extensions/bucketed-pull.md`

Start with pubsub-node/docs/extensions/bucketed-pull.md and trace the Event::Epoch { nonce } seam mentioned in the issue. Compare block-hash and VRF sources, analyze their grinding resistance, and record the security argument. Done means the beacon design, analysis, and confirmation that this is the only required seam are documented; deployment integration is out of scope.

Written by the indexing model from the issue text.