fix(web): enable getrandom js feature for wasm32 target

rand 0.8 depends on getrandom 0.2, which refuses to compile on
wasm32-unknown-unknown without its "js" feature (it needs to call into the
Web Crypto API via wasm-bindgen). Bevy's own rand usage sits on getrandom
0.3+, which enables this by default, so the web build only broke once we
added a direct rand 0.8 dep in 76be513.

Force-enabling getrandom/js in the wasm32 target deps section unblocks
`trunk build`. Desktop is unaffected (the cfg gates it to wasm only).
Caught by the Task 8 wasm cargo-check gate.

Cargo.lock

@@ -2832,8 +2832,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -4960,6 +4962,7 @@ version = "0.1.0"
 dependencies = [
  "bevy",
  "bevy_egui",
+ "getrandom 0.2.17",
  "js-sys",
  "rand 0.8.7",
  "rand_chacha",

Cargo.toml

@@ -21,6 +21,13 @@ rand_chacha = "0.3"
 web-sys = { version = "0.3", features = ["Gpu", "Navigator", "Window", "Document", "HtmlElement", "Element"] }
 wasm-bindgen = "0.2"
 js-sys = "0.3"
+# rand 0.8 pulls getrandom 0.2, which on wasm32-unknown-unknown refuses to
+# compile unless its "js" feature is explicitly enabled (it calls into the
+# Web Crypto API via wasm-bindgen). Bevy's own rand usage is on getrandom
+# 0.3+, which enables this by default; our direct rand 0.8 dep does not.
+# Force-enabling it here unblocks the web build. See getrandom docs:
+# https://docs.rs/getrandom/#webassembly-support
+getrandom = { version = "0.2", features = ["js"] }
 
 # Desktop release tuning. This renderer is GPU-bound, but Bevy's CPU path
 # (resource management, system scheduling, egui, wgpu command submission)