ZK-058: Add browser-safe note randomness boundary

[alceops]

Summary

• adds a runtime-safe secure randomness boundary for SDK note generation
• supports browser Web Crypto getRandomValues and Node crypto.randomBytes without a top-level Node crypto import
• keeps deterministic/randomness injection isolated for tests and fails clearly when no secure source is available

Verification

• npm test -- --runInBand random.test.ts
• npm run build

Note: full npm test -- --runInBand currently fails on pre-existing/mainline unrelated witness/public-input expectations (for example golden_vectors.test.ts expects the old packWithdrawalPublicInputs arity and malformed witness tests expect WitnessValidationError while current code wraps ProvingError).

Closes #302

[alceops]

This PR is now superseded by changes already merged into main via #332, which closed #302 and implemented the browser-safe note randomness path. Closing this to avoid keeping a conflicting/obsolete PR open. No payout claim from this PR.