Use crypto-backed workdir IDs

[Copilot]

Workdir names were derived from Math.random(), making /tmp/band-exec-* paths predictable to local processes. This could allow pre-created path attacks against per-execution files.

• ID generation
  • Replaced non-cryptographic random IDs with crypto.randomBytes(8).
  • Produces 16-character hex IDs for workdir suffixes.

import { randomBytes } from "crypto";

export function randomId(): string {
  return randomBytes(8).toString("hex");
}

• Server integration

  • Updated band-server to use the crypto-backed helper for execution workdir names.

• Regression coverage

  • Added unit coverage for ID format and to guard against reintroducing Math.random().