feat(stdlib): finish Crypto (CSPRNG + base64) and add Uuid.* library (#19 #16)

Crypto (#19): add the OS cryptographically-secure random surface
(random_bytes/random_hex/random_u32, reading /dev/urandom) and a standard
base64 encoder, completing the library alongside the existing SHA-256/
HMAC-SHA256/verify_hmac/hex/ct_equal. All pure integer IR, C-free.

Uuid (#16): a new namespace for stable, collision-free IDs — v4 (random) and
v7 (time-ordered) generation, plus parse/is_valid/to_text/equals/nil. UUIDs are
canonical lowercase 36-char strings; v4 and v7's random tail draw from the
crypto CSPRNG, so both carry the documented determinism caveat (mint at the
edges, never inside lockstep simulation). Reuses the crypto prelude's
fn_secure_bytes / fn_hex_encode.

- examples/library/{crypto,uuid}.ludic: known-answer vectors (SHA-256, HMAC,
  base64 per RFC 4231/4648) and structural invariants (uuid version/variant
  bits, parse/equals), wired into `x test` (now 51 passed).
- docs: per-symbol pages for every new method + a new Uuid section; inventory
  and impl-vs-docs coverage check pass.
- seed regenerated; `x bootstrap-cfree` fixpoint holds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/language/crypto/_section.md

@@ -8,4 +8,6 @@ Secure, test-vector-backed hashing for the handful of security-sensitive things
 
 Digests are returned as lowercase hex strings, not raw bytes — a <code>str</code> is null-terminated and a raw digest can contain a zero byte, so hex is the form you can print, store, and compare directly.
 
+Alongside hashing, this library exposes the OS cryptographically-secure random generator — <a href="crypto-random_bytes"><code>random_bytes</code></a>, <a href="crypto-random_hex"><code>random_hex</code></a>, and <a href="crypto-random_u32"><code>random_u32</code></a> — for tokens, nonces, and <a href="ns-Uuid"><code>Uuid</code></a> generation, plus <a href="crypto-base64"><code>base64</code></a> for moving bytes through text-only channels. The secure-random helpers are deliberately non-deterministic and must never seed the lockstep simulation RNG (<a href="ns-Random"><code>Random</code></a>).
+
 What this is not: it is not DRM and it is not unbeatable anti-cheat. A client-side game cannot keep a secret from the machine it runs on — a determined owner can always read the key out of the binary. Use it to make *casual* tampering detectable and to authenticate messages between parties who share a key. To verify a MAC always use <a href="crypto-verify_hmac"><code>Crypto.verify_hmac</code></a> (a constant-time check), never <code>==</code>, which leaks how much of a guessed MAC was correct.

docs/language/crypto/crypto-base64.md

@@ -0,0 +1,28 @@
+---
+id: crypto-base64
+name: Crypto.base64
+category: crypto
+kind: namespace-method
+tokens: Crypto.base64
+sig: Crypto.base64(s) -> string
+tip: Standard base64 (RFC 4648) of a string's bytes.
+order: 9
+ns: Crypto
+member: base64
+---
+
+Encodes the bytes of <code>s</code> as standard base64 (RFC 4648, the <code>A–Z a–z 0–9 + /</code> alphabet with <code>=</code> padding). Base64 turns arbitrary bytes into printable ASCII, which is what you want when a digest, key, or binary blob has to travel through a text-only channel — a JSON field, a URL-safe token wrapper, a config file, a log line. It is an *encoding*, not encryption: it hides nothing and adds no integrity. Pair it with <a href="crypto-hmac_sha256"><code>Crypto.hmac_sha256</code></a> when the payload must also be tamper-evident.
+
+The output length is always a multiple of four; a one- or two-byte remainder in the input is padded with <code>=</code>.
+
+Parameters:
+- `s` — the string whose bytes are encoded
+
+```ludic
+program Encode {
+  entry {
+    print(Crypto.base64("foobar"))   # Zm9vYmFy
+    print(Crypto.base64("f"))        # Zg==
+  }
+}
+```

docs/language/crypto/crypto-random_bytes.md

@@ -0,0 +1,28 @@
+---
+id: crypto-random_bytes
+name: Crypto.random_bytes
+category: crypto
+kind: namespace-method
+tokens: Crypto.random_bytes
+sig: Crypto.random_bytes(n) -> string
+tip: n bytes from the OS CSPRNG, as a 2n-character hex string.
+order: 6
+ns: Crypto
+member: random_bytes
+---
+
+Draws <code>n</code> bytes from the operating system's cryptographically-secure random number generator and returns them as a <code>2n</code>-character lowercase hex string. Use it for unguessable tokens, nonces, and session secrets — anything whose whole value is that an attacker cannot predict it. The result is hex rather than raw bytes for the same reason digests are: a <code>str</code> is null-terminated and raw random bytes can contain a zero byte, so hex is the form you can safely store and compare.
+
+This is deliberately **non-deterministic** — it must never seed the lockstep simulation RNG (<a href="ns-Random"><code>Random</code></a>). Two calls return different values. On a platform without an OS CSPRNG (for example a bare wasm target) the draw degrades to zeroes rather than faulting; treat a real CSPRNG there as a platform-layer responsibility.
+
+Parameters:
+- `n` — the number of secure random bytes to draw
+
+```ludic
+program Token {
+  entry {
+    let session = Crypto.random_bytes(16)   # 32 hex chars, unguessable
+    print(len(session))                      # 32
+  }
+}
+```

docs/language/crypto/crypto-random_hex.md

@@ -0,0 +1,26 @@
+---
+id: crypto-random_hex
+name: Crypto.random_hex
+category: crypto
+kind: namespace-method
+tokens: Crypto.random_hex
+sig: Crypto.random_hex(n) -> string
+tip: Alias for random_bytes — n secure bytes as a 2n-char hex string.
+order: 7
+ns: Crypto
+member: random_hex
+---
+
+Identical to <a href="crypto-random_bytes"><code>Crypto.random_bytes</code></a>: draws <code>n</code> bytes from the OS CSPRNG and returns them as a <code>2n</code>-character lowercase hex string. The two names are interchangeable; <code>random_hex</code> exists so call sites can be explicit that the return value is already hex text (not raw bytes) when that reads more clearly. The same determinism caveat applies — the result is unpredictable by design and must stay out of the reproducible simulation RNG.
+
+Parameters:
+- `n` — the number of secure random bytes to draw
+
+```ludic
+program Nonce {
+  entry {
+    let nonce = Crypto.random_hex(12)   # 24 hex chars
+    print(len(nonce))                    # 24
+  }
+}
+```

docs/language/crypto/crypto-random_u32.md

@@ -0,0 +1,26 @@
+---
+id: crypto-random_u32
+name: Crypto.random_u32
+category: crypto
+kind: namespace-method
+tokens: Crypto.random_u32
+sig: Crypto.random_u32() -> int
+tip: One CSPRNG-drawn 32-bit integer.
+order: 8
+ns: Crypto
+member: random_u32
+---
+
+Draws four bytes from the OS CSPRNG and assembles them into one 32-bit integer. Use it when you need a single unpredictable number rather than a hex string — a random challenge value, a per-run identifier, or a non-deterministic seed to hand to a *fresh* <a href="ns-Random"><code>Random</code></a> stream at startup. Because the bytes come from the secure generator, the value prints as a signed integer and can be negative.
+
+Like the other secure-random helpers this is **non-deterministic** and must not be called inside the lockstep simulation: doing so desyncs replays and networked peers. Draw it at the edges (startup, on connect) and, if you need reproducible gameplay randomness afterward, seed <a href="random-seed"><code>Random.seed</code></a> with it once.
+
+```ludic
+program Challenge {
+  entry {
+    let c = Crypto.random_u32()
+    Random.seed(value: c)          # non-deterministic seed, chosen once at startup
+    print(Random.int(100))
+  }
+}
+```