//! Thin wrapper around `getrandom` for fixed-size random byte arrays.
/// Fill and return a fresh array of cryptographically secure random bytes.
///
/// # Panics
///
/// Panics if the OS random number generator is unavailable. This is treated
/// as an unrecoverable environment fault: silently continuing without a
/// working CSPRNG would mean generating predictable session keys and
/// nonces, which is a far worse outcome than aborting.
// unreachable_pub requires pub(crate) here; this module is crate-private either way
pub