chore(deps): bump rand to 0.10 with RngExt fix

[lavs9]

Summary

Supersedes #38 (Dependabot's rand 0.9 → 0.10 bump). Same version bump, plus the 2-line source fix it needs to actually compile, squashed into one atomic commit.

Why #38's CI failure was stale

#38's CI run failed with E0599: no method named random_range found for StdRng in quantwave-backtest/src/tpe.rs. That looked like a live defect, but it wasn't: the branch is several days old and its CI ran against an older main that still pinned rand = "0.8" and used gen_range (the 0.8 API). Main has since moved and the failure no longer reflects current main's behavior against 0.10.

Rebasing surfaces the real issue: rand 0.10 splits the Rng trait — range/fill helpers (random_range, random, etc.) move out of Rng into a new RngExt trait. quantwave-backtest calls those helpers (tpe.rs, and the test module in lib.rs), so the crate doesn't compile against 0.10 without also importing RngExt.

Why the bump and the fix must be atomic

rand::RngExt does not exist in 0.9. A commit that adds the RngExt import before bumping the dependency fails to compile (no such trait). A commit that bumps the dependency before adding the import also fails to compile (0.10 no longer exposes those methods on Rng). Splitting them across two commits leaves a broken bisect point either way, so both changes land together here in a single commit.

Changes

• Cargo.toml: rand = "0.9" → rand = "0.10"
• Cargo.lock: dependency graph updated for the bump (also picks up thiserror 2.0.18 → 2.0.19 as a transitive update)
• quantwave-backtest/src/tpe.rs: use rand::Rng → use rand::RngExt
• quantwave-backtest/src/lib.rs (test module): use rand::Rng → use rand::RngExt

Verification

Ran locally before pushing:

• cargo build --workspace: 0 errors
• cargo nextest run --workspace: 1138 passed, 1 skipped, 0 failed

Test plan

• cargo build --workspace succeeds
• cargo nextest run --workspace — 1138 passed, 1 skipped, 0 failed
• CI green on this PR

🤖 Generated with Claude Code

[lavs9]

Force-pushed a correction. The first push of this branch reused an older local WIP branch as its base and, in doing so, silently reverted two NaN-safety regression tests in tpe.rs that had landed on main after that WIP branch was cut:

• test_tpe_select_from_pool_never_selects_a_nan_objective
• test_tpe_select_from_pool_all_nan_falls_back_to_neg_infinity

Those tests guard the in-fold TPE optimizer against selecting an undefined objective, and a dependency bump has no business touching them. They are restored. The diff against main is now exactly two lines, both use rand::Rng -> use rand::RngExt.

Workspace tests: 1140 passed, 1 skipped, 0 failed (was 1138 before the restore -- the two-test delta is the tests coming back).