chore: update rand to 0.10.0 and add version-bump agent instructions

[Copilot]

Adopts rand 0.10.0 from the Renovate branch and adds agent instructions for handling future breaking dependency bumps. The existing rand usage (rand::rng() and SliceRandom::shuffle) is already compatible with 0.10.0 — no source changes were required.

Changes

• Cargo.lock — Updated to reflect rand 0.10.0 and transitively updated dependencies (rand_core 0.10.0, chacha20 0.10.0, etc.)
• .github/agents/version-bump-help.agent.md — New agent instructions file documenting the workflow for fixing dependency version bump PRs, including:
  • How to research breaking changes and find affected usages
  • How to build, fix, and verify
  • Common fix patterns (trait renames, function renames, removed features, type changes)
  • PRs should target main directly — not the Renovate/Dependabot branch — to avoid interfering with automated tooling

Original prompt

Problem

PR #1195 updates the rand crate from 0.9.2 to 0.10.0 in the workspace Cargo.toml, but the build fails because rand 0.10.0 has several breaking API changes.

Fixes #1195

Breaking Changes in rand 0.10.0

Based on the rand 0.10.0 changelog:

1. Rng trait renamed to RngExt — The Rng extension trait has been renamed to RngExt because upstream rand_core renamed RngCore → Rng. Any use rand::Rng; import needs to become use rand::RngExt;, and any trait bounds R: Rng need updating.
2. choose_multiple → sample — IndexedRandom::choose_multiple was renamed to sample, and SliceChooseIter renamed to IndexedSamples.
3. OsRng → SysRng, OsError → SysError, os_rng → sys_rng — system RNG was renamed.
4. Removed SeedableRng::from_os_rng, try_from_os_rng
5. Removed Clone for StdRng
6. Removed ReseedingRng
7. Removed feature small_rng
8. rand::rng() function — This still exists and returns a thread-local RNG. It was introduced in 0.9.

What the Code Currently Uses

The only file that directly uses rand is crates/weaver_resolver/src/registry.rs in the #[cfg(test)] mod tests block:

use rand::rng;
use rand::seq::SliceRandom;

And later:

let mut rng = rng();
attr_refs.shuffle(&mut rng);

The SliceRandom trait provides shuffle, which still exists in 0.10.0. The rand::rng() function still exists. However, the underlying trait changes may cause compilation issues.

What Needs to Be Done

1. Check out the renovate/rand-0.x branch (which already has the Cargo.toml change to rand = "0.10.0").
2. Run cargo build and cargo test to see the actual compilation errors.
3. Fix the compilation errors — Based on the analysis above, the likely fixes in crates/weaver_resolver/src/registry.rs are:
   • If there's an error about Rng trait not found, change use rand::Rng to use rand::RngExt
   • The shuffle method on SliceRandom requires the RNG argument to implement rand_core::Rng (which was RngCore in 0.9). In 0.10, the return type of rand::rng() should implement the new rand_core::Rng trait, so shuffle(&mut rng) should work.
   • If there are issues with SliceRandom not being in scope, check if it moved or was renamed.
4. Run cargo test -p weaver_resolver to ensure tests pass.
5. Run cargo build --workspace to make sure the whole workspace compiles.
6. Run cargo clippy --workspace to ensure no clippy warnings.

Also: Create Agent Instructions File

Create a file .github/agents/version-bump-help.agent.md with instructions for future dependency bump tasks. The file should describe the general workflow for handling dependency update PRs:

# Version Bump Helper Agent Instructions

## Purpose
Help fix dependency update PRs (from Renovate, Dependabot, etc.) that fail to build due to breaking API changes.

## Workflow

1. **Identify the dependency and version change** — Read the PR description to determine which crate is being updated and from/to which versions.

2. **Research breaking changes** — Check the crate's CHANGELOG, release notes, or migration guide for API changes between the old and new versions.

3. **Find all usages in the codebase** — Search for all `use` statements and direct references to the dependency across the workspace:
   - Search for `use <crate_name>::` in all `.rs` files
   - Search for `<crate_name>::` in all `.rs` files  
   - Check all `Cargo.toml` files for feature flags that may have been added/removed/renamed

4. **Build and collect errors** — Run `cargo build --workspace` and `cargo test --workspace --no-run` to collect all compilation errors.

5. **Fix each error** — For each error:
   - If a type/trait/function was renamed, update the import and all usages
   - If a function signature changed, update the call sites
   - If a feature was removed, remove it from Cargo.toml
   - If a type was removed, find the replacement in the new version's docs

6. **Verify the fix** — Run:
   - `cargo build --workspace` — ensure everything compiles
   - `cargo test --workspace` — ensure all tests pass
   - `cargo clippy --workspace` — ensure no new warnings

7. **Create a PR** — The new PR should:
   - Be based on the original dependency update branch
   - Include "Fixes #<original PR number>" in the description
   - Clearly describe what API changes were needed

## Common Patterns

### Trait Renames
When a trait is renamed (e.g., `Rng` → `RngExt`):
- Update all `use` imports
- Update all trait bounds in generic functions
- Update any fully-qualified paths

### Function Renames  
When functions are renamed (e.g., `choose_multiple` → `sample`):
- Update all call sites
- Check if the return type also changed

### Removed Features
When a Cargo feature is removed:
- Remove it from all `Cargo.toml` files that reference it
- Check if the fun...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>

<!-- START COPILOT CODING AGENT TIPS -->
---

✨ Let Copilot coding agent [set things up for you](https://github.com/open-telemetry/weaver/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo.

[jsuereth]

@copilot can you change this PR to be against the main branch, or open a new one with the same instructions against the main branch?

[Copilot]

@copilot can you change this PR to be against the main branch, or open a new one with the same instructions against the main branch?

I'm not able to change the base branch of an existing PR or create a new one with the tools available to me. The only meaningful change in this branch beyond the renovate branch is the .github/agents/version-bump-help.agent.md file.

The quickest fix is to manually change this PR's base branch in the GitHub UI from renovate/rand-0.x → main. Once that's done the Cargo.lock diff from the renovate branch will disappear, leaving only the agent instructions file as the change.

If you'd prefer a brand-new PR, you can create a branch off main, copy .github/agents/version-bump-help.agent.md into it, and open the PR from there.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.8%. Comparing base (e23af35) to head (69c9d88).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #1269     +/-   ##
=======================================
- Coverage   80.8%   80.8%   -0.1%     
=======================================
  Files        111     111             
  Lines       9308    9308             
=======================================
- Hits        7523    7521      -2     
- Misses      1785    1787      +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jsuereth]

This fixes the broken rennovate PR, although - that failure was likely transient.