Ban Math.random package-wide and enforce it in CI

Neither remaining Math.random call was a secret. The backup-quiz picker
chooses which three recovery words to re-type -- an attacker who cannot see
the phrase gains nothing from predicting them -- and the relay subscription
id is a public wire identifier scoped to one socket, where collision is the
only failure mode.

They are changed anyway, because the point is the rule rather than these two
call sites. A Math.random ban that carries a standing exception is worth
much less than one that does not: the exception is what a future misuse
hides behind, and reviewers stop reading a warning they have already agreed
to ignore twice. Both now use the CSPRNG (randomUniformInt, and
bytesToHex(randomBytes(8)) for the subscription id, same 16-hex-character
shape as before), which costs nothing here.

With no exception left, the rule can be absolute. .semgrep.yml adds three
rules over packages/*/src/**, run in CI as a separate step after
--config auto:

- bitlogin-no-math-random: no Math.random anywhere, secret or not
- bitlogin-no-crypto-fallback: no `?? fallback`, `|| fallback`, or
  catch-and-substitute around getRandomValues -- the COLDCARD defect class
- bitlogin-no-time-or-id-seeded-secrets: no hashing Date.now() or
  performance.now() into a key

Verified the rules fire rather than merely passing, which is the failure
mode of a lint rule nobody tests: reintroducing the old
Math.floor(Math.random() * pool.length) produces 1 blocking finding and exit
1, and the tree is clean at 0 findings with it restored. Path patterns are
anchored (/packages/...) so semgrep's upcoming Semgrepignore v2 change does
not silently alter their scope.

Typecheck and the full suite pass (185 tests).

This closes the entropy audit for this repo. The only gate remaining is an
independent review of the RNG path by someone other than the author.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u

packages/widget/src/element.ts

@@ -7,6 +7,7 @@ import {
   type RecoveryExportFile
 } from "@bitlogin/core/account";
 import { encodeNpub } from "@bitlogin/core/nostr";
+import { randomUniformInt } from "@bitlogin/core/crypto";
 import { WorkerClient } from "./worker/workerClient.js";
 import { createNip07Provider, type Nip07Provider } from "./provider.js";
 import { readConfigFromElement } from "./config.js";
@@ -1468,12 +1469,22 @@ export class BitLoginAuthElement extends HTMLElement {
   }
 }
 
+/**
+ * Picks `count` distinct indices in [0, max) for the write-it-down confirmation
+ * quiz.
+ *
+ * This is not a secret and leaks no entropy — the recovery phrase itself comes
+ * from randomEntropy128, and an attacker who cannot see the phrase gains
+ * nothing from predicting which words get quizzed. It uses the CSPRNG anyway so
+ * that `Math.random` can be banned outright in this package (see
+ * .semgrep.yml). A ban with a standing exception is where the next real misuse
+ * hides.
+ */
 function pickRandomIndices(max: number, count: number): number[] {
   const pool = Array.from({ length: max }, (_, i) => i);
   const chosen: number[] = [];
   for (let i = 0; i < count && pool.length > 0; i++) {
-    const idx = Math.floor(Math.random() * pool.length);
-    chosen.push(pool.splice(idx, 1)[0]!);
+    chosen.push(pool.splice(randomUniformInt(pool.length), 1)[0]!);
   }
   return chosen.sort((a, b) => a - b);
 }