refactor(foundation): remove SEED randomness path, fix modulo bias

[spalladino]

Context

Foundation's randomBytes switched to a counter-based generator whenever the SEED env var was set — process-wide, inside the production code path. Everything downstream inherited it: Fr.random(), and from there admin API keys (aztec/src/cli/admin_api_key_store.ts), BLS keystore salts and AES IVs, L1→L2 message secrets (aztec.js/src/ethereum/portal_manager.ts), deployment salts, and account signing keys. With SEED=42, randomBytes(32) returns 2a0000002a0000002a.... That is what TODO(#3949) warned about.

Nothing sets SEED — not CI, helm charts, terraform, bootstrap scripts, or jest setup — and nothing outside randomBytes ever referenced the singleton, which was not exported from the package. It was introduced by #5155 in March 2024 and untouched since. Test-data regeneration uses a separate variable, AZTEC_GENERATE_TEST_DATA.

The same TODO also flagged randomInt/randomBigInt as modulo biased. The bias itself was negligible at every call site (~max / 2^48), but the fixed sample width hid a real bug: randomInt drew 6 bytes, so for max > 2^48 the reduction was a no-op and the range was silently truncated. randomInt(Number.MAX_SAFE_INTEGER) could only reach 1/32 of its range.

Approach

randomBytes now always sources from bb.js, which uses node crypto or WebCrypto depending on environment.

randomBigInt masks a draw down to ceil(log2(max)) bits and resamples on overflow. That is exactly uniform, and because the mask width is chosen so 2^(bits-1) < max <= 2^bits, acceptance stays above 1/2 and the expected draw count below 2. Scaling the draw to max also removes the truncation. randomInt delegates to it, so both are fixed in one place — node's unbiased crypto.randomInt is not an option here, since foundation also runs in the browser.

Both now reject a non-positive max (and a non-safe-integer max for randomInt) rather than returning a nonsensical value. No existing caller can reach the throw: the only two production call sites are fault-injection knobs in sequencer-client guarded by config, and everything else passes a positive literal or a MAX_*_PER_TX constant.

API changes

SEED no longer has any effect. Anyone relying on it for deterministic runs will now get real randomness; there is no replacement, as the seeded generator was not safe to leave reachable from production key derivation.

randomInt and randomBigInt now throw RangeError on a non-positive max instead of returning a garbage value, and randomInt additionally rejects non-safe-integer maxima.

Resolves the seeded-randomness and modulo-bias halves of #3949.