test: use crypto.randomUUID for query-engine fixture uuids (#2289)

CodeQL default setup flagged js/insecure-randomness (alert #72, high)
on the custom-pricing budget fixture, which built message uuids from
Math.random(). The values never leave the test process, but the field
is typed as UUID and the same pattern appeared in three places across
two fixtures.

Generate the uuids with crypto.randomUUID() instead. This clears the
alert, matches the Message uuid type, and drops the
`as Message['uuid']` cast in the manual-compact cooldown fixture.
Nothing depended on the old user-/assistant-/test- prefixes.

Co-authored-by: OpenClaude <openclaude@gitlawb.com>

src/test/fixtures/queryEngineCustomPricingBudget.fixture.ts

@@ -1,5 +1,6 @@
 import { mock } from 'bun:test'
 import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -45,7 +46,7 @@ mock.module('../../utils/processUserInput/processUserInput.js', () => ({
         type: 'user',
         message: { role: 'user', content: 'run' },
         isMeta: false,
-        uuid: `user-${Math.random()}`,
+        uuid: randomUUID(),
         timestamp: new Date().toISOString(),
       } as Message,
     ],
@@ -112,7 +113,7 @@ async function* pricedQuery({
       stop_sequence: null,
       usage,
     },
-    uuid: `assistant-${Math.random()}`,
+    uuid: randomUUID(),
     timestamp: new Date().toISOString(),
   } as Message
 }

src/test/fixtures/queryEngineManualCompactCooldown.fixture.ts

@@ -1,5 +1,6 @@
 import { mock } from 'bun:test'
 import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -19,7 +20,7 @@ function compactBoundaryMessage(): Message {
     content: 'Conversation compacted',
     isMeta: false,
     timestamp: new Date().toISOString(),
-    uuid: `test-${Math.random()}` as Message['uuid'],
+    uuid: randomUUID(),
     level: 'info',
     compactMetadata: {
       trigger: 'manual',