Add system randomness providers and a portable std::random API

Tracked by #375 and represented in #378.

## Problem

Wave has no standard source of operating-system entropy. Applications should not need to reach into libc bindings or invent insecure pseudo-random fallbacks.

## Scope

- Add target providers under std::sys for Linux and macOS.
- Define future provider contracts for Windows, FreeBSD, and WASI.
- Add a portable buffer-filling API under std::random.
- Handle interruption, partial fills, unavailable providers, and zero-length requests.
- Keep cryptographic entropy separate from deterministic pseudo-random generators.
- Never fall back silently to time, process IDs, or weak generators.

## Completion criteria

- [ ] Supported hosted targets can fill a caller-owned byte buffer.
- [ ] Runtime tests reject an all-constant or unmodified buffer.
- [ ] Error and partial-read behavior is documented.
- [ ] Unsupported targets fail explicitly.
- [ ] WASI capability behavior links to #367.

Start by reviewing the existing std::sys structure and the proposed std::random API, then read issues #375, #378, and #367 for related design context. Verify the supported Linux and macOS providers, buffer-filling behavior, runtime checks, documented errors, and explicit failures on unsupported targets against the completion criteria.

Written by the indexing model from the issue text.