build: fix rand advisory and harden python CI caching (#675)

Update Cargo.lock to move rand to 0.10.1 so cargo-deny stops failing on RUSTSEC-2026-0097.

Also tighten the Python workflow cache boundaries by keying rust-cache to pinned runner images. The workflow now keeps Ubuntu 22.04, Ubuntu 24.04, and Windows 2022 caches separate, which avoids reusing host build artifacts across runner image changes. That is the class of issue behind the intermittent GLIBC mismatch seen in CI.

.github/workflows/test-python.yml

@@ -18,7 +18,7 @@ jobs:
         host:
           - name: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
-          - name: windows-latest
+          - name: windows-2022
             target: x86_64-pc-windows-msvc
     runs-on: ${{ matrix.host.name }}
     steps:
@@ -32,7 +32,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: ${{ runner.os }}-regorus
+          shared-key: ${{ runner.os }}-${{ matrix.host.name }}-regorus
       - name: Fetch dependencies
         run: cargo fetch --locked
 
@@ -60,9 +60,12 @@ jobs:
     needs: build
     strategy:
       matrix:
-        host: [ubuntu-24.04, ubuntu-22.04, windows-latest]
+        host:
+          - name: ubuntu-24.04
+          - name: ubuntu-22.04
+          - name: windows-2022
         python-version: ["3.10", "3.11", "3.12", "3.13"]
-    runs-on: ${{ matrix.host }}
+    runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -72,7 +75,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          shared-key: ${{ runner.os }}-regorus
+          shared-key: ${{ runner.os }}-${{ matrix.host.name }}-regorus
       - name: Fetch dependencies
         run: cargo fetch --locked
 

Cargo.lock

@@ -1239,9 +1239,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",