feat(vfs): add /dev/urandom and /dev/random to virtual filesystem

[chaliy]

Summary

• Add /dev/urandom and /dev/random as virtual device files in InMemoryFs
• Reads return 8KB of random bytes per call, preventing unbounded memory growth (TM-DOS-003)
• Supports common patterns like od -An -N8 -tx1 /dev/urandom that previously failed with "file not found"

What changed

• crates/bashkit/src/fs/memory.rs: Register /dev/urandom and /dev/random as VFS entries; intercept read_file to return bounded random bytes via RandomState hasher
• specs/003-vfs.md: Document new device files
• specs/006-threat-model.md + crates/bashkit/docs/threat-model.md: Update TM-DOS-003 mitigation from "No /dev/urandom in VFS" to "bounded 8KB reads"
• Updated file count limits in existing tests to account for 2 new initial files

Test plan

• Unit tests: read returns 8192 bytes, different data each read, exists check, write-then-read still returns random, path normalization bypass
• Integration tests: od -An -N8 -tx1 /dev/urandom, cat /dev/urandom > /dev/null, input redirect < /dev/urandom, /dev/random parity
• Security: path traversal via /dev/../dev/urandom resolves correctly
• Existing tests updated: file count limits, overlay symlink limits
• Full suite: 1986 tests pass, clippy clean, fmt clean