fix(crypto): seed the IV generator from OS entropy, not the wall clock

[gburd]

Deferred security item from the 2026-08 review. Encryption IV unpredictability was weak: the Mersenne Twister behind __db_generate_iv was seeded from __os_gettime() hashed wall-clock seconds, so an attacker who knows roughly when the environment was created can narrow the IV stream. (AES-CBC mode and IV uniqueness were already correct — only unpredictability was at issue.)

The fix

• New src/os/os_csprng.c — __os_csprng() fills a buffer from the OS CSPRNG: getrandom(2) where available, else arc4random_buf(3), else /dev/urandom through the os layer. It returns an error rather than silently degrading.
• configure: probe getrandom, arc4random_buf, sys/random.h; db_int.in includes <sys/random.h> when present. Registered in srcfiles.in, dist/Makefile.in, dist/meson.build (POSIX only — Windows keeps its own path and the historical fallback).
• mt19937db.c: seed from __os_csprng(), falling back to the hashed clock only if the OS has no entropy source, so encryption still functions there.

Also fixes a latent tooling breakage found while doing this

Our SSI work put category-9 message IDs (4573/4574) into src/common/db_err.c, which is message category 0 (range 1–500). dist/s_message_id therefore computed a next-ID of 4575, exceeded category 0's max, and reported RANGE FULL — silently blocking any new DB_STR in src/os, src/common, src/crypto, src/hmac or src/fileops. Reassigned those two to 0211/0212 (the DB_SNAPSHOT_CONFLICT/DB_SNAPSHOT_UNSAFE strings themselves are unchanged) and gave os_csprng 0213. s_message_id now runs clean.

This is the same root-cause class as #140: SSI touched a shared convention without auditing it.

Verified

Probes detected (HAVE_GETRANDOM, HAVE_SYS_RANDOM_H, HAVE_ARC4RANDOM_BUF); build clean; a direct check confirms two __os_csprng draws differ and are non-zero; sec001, sec002 (encryption) and test001 btree/hash pass.

[github-actions]

ABI diff produced no report (build skipped or no base tag).

---

Advisory: libabigail/nm is the authoritative binary-ABI check; Coccinelle is complementary source-level early warning. See dist/cocci/README.md.

[github-actions]

Coccinelle convention checks

No new violations. ✅

Resolved since baseline (2) -- update dist/cocci/baseline.txt to lock these in.

rule_mutex_unbalanced|MUTEX_UNBALANCED|src/crypto/mersenne/mt19937db.c|return (ret);
rule_mutex_unbalanced|MUTEX_UNBALANCED|src/mp/mp_register.c|return (ret);