docs(10): correct F-10's scope and add KEY-05 — crate-wide CSPRNG enforcement

The audit recorded F-10 as two call sites in container/secrets.rs. The real
defaulted-RNG surface is 41 sites across 15 files: session.rs (16),
pine_ha.rs (6), wallet/bdhke.rs (4 — ecash key material), mesh/x3dh.rs (2 —
key-agreement material), storage_crypto.rs (1 — AEAD nonce), +10 more.

Nothing is broken today: rand::random()/thread_rng() are ChaCha12 seeded from
getrandom(2). What changes is blast radius — F-10's Low rating rested on
'per-app credentials rather than the master key hierarchy', which does not
survive the true scope. Re-rated Medium as F-10a.

Records why the original audit missed it: F-10 was reached by tracing the
manifest-secrets path, and no step enumerated defaulted-RNG use across the
crate independently of the traced paths.

F-10's original text is left unedited so the correction is auditable rather
than retroactive. R-13 superseded by R-16; tracker item replaced.

Adds KEY-05 to Phase 10: sealed allowlist trait at key-gen seams, clippy
disallowed-methods ban (compile-time, CI-enforced), cargo-deny on duplicate
rand majors, degenerate-entropy runtime check, persisted CSPRNG-readiness
verdict. Also retires the false 'impl CryptoRng for CountingRng' at
seed.rs:656.

Records the user's execution gate: Phase 10 does not start until the
concurrent Phase 1 agent is finished and their changes are synced. KEY-05 is
unplanned — the existing 5 plans predate it and a 6th is required.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/UNIFIED-TASK-TRACKER.md

@@ -100,12 +100,26 @@ those are marked ✅ below with the commit that did it, so we stop re-litigating
     `Math.random()` picks a UX challenge, not key material, so the next auditor does
     not re-derive that it is benign.
 
-- [ ] **Swap container `generated_secrets` to explicit `OsRng`** (entropy audit R-13,
-      finding F-10) — `random_hex`/`random_base64` in
-      `core/archipelago/src/container/secrets.rs:90-102` use `thread_rng()`. Correct on
-      `rand 0.8.5`, but the same implicit-source pattern as [ARCHY-1]. Two-line change.
-      **Currently blocked only on tree hygiene** — that file had another agent's
-      uncommitted work when the audit ran.
+- [ ] ~~**Swap container `generated_secrets` to explicit `OsRng`** (entropy audit R-13,
+      finding F-10) — two-line change in `container/secrets.rs:90-102`~~
+      **SUPERSEDED 2026-08-02 by R-16 / KEY-05.** The audit scoped this at 2 call sites; the
+      real surface is **41 across 15 files** — see the audit's new §F-10a. `secrets.rs` is 2
+      of them, and a two-line fix there while 39 other sites inherit the same dependency
+      default is not a fix.
+
+- [ ] **Crate-wide CSPRNG enforcement — a defaulted RNG cannot be inherited anywhere**
+      (entropy audit **R-16 / F-10a**, Medium) — tracked as **KEY-05 in Phase 10**, so plan
+      and execute it there rather than as a standalone item. `session.rs` (16 sites),
+      `pine_ha.rs` (6), `wallet/bdhke.rs` (4 — **ecash key material**), `mesh/x3dh.rs` (2 —
+      **key-agreement material**), `storage_crypto.rs` (1 — **AEAD nonce**), +10 more files.
+      Nothing is broken today (`rand::random()`/`thread_rng()` are ChaCha12 from
+      `getrandom(2)`), but it is the T1 shape that produced the COLDCARD defect, now with key
+      material in the blast radius. Five layers: sealed allowlist trait at key-gen seams;
+      `clippy.toml` `disallowed-methods` ban (compile-time, CI-enforced — no `clippy.toml`
+      exists yet); `cargo-deny` on duplicate `rand` majors (absorbs R-05); degenerate-entropy
+      runtime check; persist the CSPRNG-readiness verdict (absorbs R-09). Also retires the
+      `impl rand::CryptoRng for CountingRng` false promise at `seed.rs:656`.
+      **Gated: do not start until the concurrent Phase 1 agent is done and synced.**
 
 ## Tier 1 — Medium effort, unblocked