ChaCha8Rng needs both crates: rand (the core traits Rng/SeedableRng) and
rand_chacha (the ChaCha8Rng type, split out of rand since 0.9). rand was
already a transitive dep via bevy_math but not declared directly.
Pinned to 0.8/0.3 (LTS, API-stable with the Bevy 0.19 ecosystem) rather
than the newer 0.10 line, which would force a wider dep upgrade.