fix(security): clear new CodeQL code-scanning alerts (round 3)

- open-sse/executors/freebuff.ts: swap Math.random() for
  crypto.randomInt() when generating the client session id sent
  upstream — closes js/insecure-randomness with no behavior change
  (still a 13-char lowercase-alnum id).
- open-sse/executors/cursor/agentEndpoint.ts:104 — Cursor Agent RPC
  URL cache key fingerprint (already HMAC-SHA256): dismissed
  js/insufficient-password-hash, same rationale as PR #10739/#10888.
- open-sse/executors/cursor.ts:1229 — already routes through
  sanitizeErrorMessage(): dismissed js/stack-trace-exposure, known
  CodeQL limitation per HR#14 precedent.
- tests/unit/combo-silent-stop-gaps.test.ts:240 — the catastrophic
  (a+)+$ pattern is the intentional G7 test fixture proving the ReDoS
  guard rejects unsafe regexes: dismissed js/redos as "used in tests".

open-sse/executors/freebuff.ts

@@ -1,3 +1,5 @@
+import { randomInt } from "node:crypto";
+
 import {
   BaseExecutor,
   type ExecuteInput,
@@ -20,7 +22,7 @@ function generateClientSessionId(): string {
   const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
   let out = "";
   for (let i = 0; i < 13; i++) {
-    out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    out += alphabet[randomInt(alphabet.length)];
   }
   return out;
 }