refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter

[jd]

ci queue-info::write_github_output formatted a unique
ghadelimiter_<uuid-v4> to guard against a metadata payload that
happens to contain its own heredoc delimiter. The actual contract
is "32 unpredictable hex chars", not "a UUID per RFC 4122" — the
delimiter is never parsed by anyone, only matched as a string.

Pull 16 random bytes straight from getrandom::fill and hex-encode
them. Drops uuid from the direct deps (it stays unreferenced and
disappears from Cargo.lock), with getrandom taking its place —
which uuid was already pulling in transitively, so the net add
is zero new code shipped to the binary.

The local helper is six lines. Same blast radius for a
maintainer-attack story, smaller surface to read.

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com

[jd]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter	#1446	👈
2	refactor(config): standardize the workspace on serde_yaml_ng for YAML parsing	#1447
3	test(ci): add live smoke test for ci scopes select-all path	#1460
4	feat(rust): port ci scopes to native Rust	#1461
5	feat(ci): swap Python's JUnit XML parser for the native Rust parser	#1465
6	feat(ci): swap Python's OTLP encode+upload for the native Rust pipeline	#1466
7	feat(ci): promote ci junit-process and its junit-upload alias to native Rust	#1467

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 🤖 Continuous Integration

Wonderful, this rule succeeded.

• all of:
  • check-success=ci-gate

🟢 👀 Review Requirements

Wonderful, this rule succeeded.

• any of:
  • #approved-reviews-by>=2
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🟢 Enforce conventional commit

Wonderful, this rule succeeded.

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?:

🟢 🔎 Reviews

Wonderful, this rule succeeded.

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

Wonderful, this rule succeeded.

• body ~= (?ms:.{48,})

[jd]

Revision history

#	Type	Changes	Reason	Date
1	initial	2cd6b4f		2026-05-20 08:42 UTC
2	rebase	2cd6b4f → 5cd88c9 (rebase only)		2026-05-20 08:42 UTC
3	rebase	5cd88c9 → 8468caf (rebase only)		2026-05-20 09:05 UTC
4	rebase	8468caf → 73811d4 (rebase only)		2026-05-21 07:25 UTC
5	rebase	73811d4 → d61afc0 (rebase only)		2026-05-21 07:56 UTC
6	rebase	d61afc0 → 637e6a8 (rebase only)		2026-05-21 12:39 UTC
7	content	637e6a8 → cdbf4bc		2026-05-22 07:10 UTC
8	rebase	cdbf4bc → c0920c6 (rebase only)		2026-05-22 14:40 UTC
9	rebase	c0920c6 → 9a4cadc (rebase only)		2026-05-27 07:53 UTC
10	rebase	9a4cadc → 258428f (rebase only)		2026-05-27 08:27 UTC
11	rebase	258428f → 9a6412d (rebase only)		2026-05-27 10:04 UTC
12	rebase	e95b052 → aa78c91 (rebase only)		2026-05-28 09:45 UTC
13	rebase	aa78c91 → 48e0093 (rebase only)		2026-05-29 06:35 UTC

Pull request has been modified.

Pull request has been modified.

Pull request has been modified.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-05-29 07:06 UTC · Rule: default
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-05-29 07:06 UTC · at 48e00934560e94f42d5ace84a30de0d2b1dcfb47 · squash

This pull request spent 18 seconds in the queue, including 3 seconds running CI.

Required conditions to merge

• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?:
    • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by>=2
      • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
    • author = dependabot[bot]
      • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
    • author = mergify-ci-bot
      • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
    • author = renovate[bot]
      • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
  • #review-requested = 0
    • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
  • #review-threads-unresolved = 0
    • refactor(ci): swap uuid for getrandom in the GHA heredoc delimiter #1446
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success=ci-gate