engine-20260905-2136

The guest now has a source of randomness: +rdrand on the CPU model and a virtio-rng-pci device, with CONFIG_HW_RANDOM_VIRTIO enabled in the kernel. Without one the random pool was empty after a resume and the first program to call getrandom() drove the kernel's TSC-jitter loop: a cold 'jj --version' took 15.2 s, of which 14.2 s was six getrandom() calls. It now takes 0.75 s. Engine files unchanged; snapshot retaken for the new machine.