let-fate-decide: replace os.urandom with secrets.randbelow

[tob-joe]

Summary

• Replace hand-rolled secure_randbelow(os.urandom) with stdlib secrets.randbelow() per @opal-escent's feedback
• Remove custom rejection-sampling function (semantically identical to secrets.randbelow)
• Use secrets.randbelow(2) for card reversal coin flips instead of os.urandom(1)[0] & 1
• Update all docstrings, SKILL.md, and README.md references from os.urandom() to secrets.randbelow()
• Add 25-test suite: deck construction, shuffle invariants, draw behavior, CLI validation, and 4 migration regression checks

Test plan

• All 25 tests pass (python3 test_draw_cards.py)
• No references to os.urandom or import os remain in draw_cards.py
• Custom secure_randbelow function fully removed
• SKILL.md and README.md updated consistently
• Script produces valid JSON output with correct structure

cc @opal-escent for review

🤖 Generated with Claude Code

[dguido]

Review: let-fate-decide secrets.randbelow migration

Verdict: Approve

Summary

Clean migration from a custom secure_randbelow() (manual rejection sampling over os.urandom()) to stdlib secrets.randbelow() and secrets.randbits(). This is the right call -- secrets.randbelow() does the same rejection sampling internally, so the custom implementation was redundant.

What was checked

• No merge conflicts with main
• Versions match: plugin.json and marketplace.json both at 1.1.0
• YAML frontmatter: valid, name is kebab-case, description is third-person with trigger phrases
• No hardcoded paths
• All 27 tests pass (deck construction, shuffle properties, CLI integration, regression checks for the migration)
• Codex skills validation passes
• Plugin metadata validation passes
• ruff clean on both Python files

Code quality notes

• Fisher-Yates shuffle is correctly implemented with secrets.randbelow(i + 1)
• secrets.randbits(1) for the coin flip is cleaner than os.urandom(1)[0] & 1
• Constants converted from lists to tuples (immutability) with matching test
• Type guard on draw(n) rejecting bools and non-ints is a nice touch
• Test suite is thorough: covers deck structure, shuffle invariants, randomness smoke tests, CLI args, and regression tests for the os-to-secrets migration

Minor observations (non-blocking)

• draw(0) silently returns [] at the library level but the CLI rejects 0 as out-of-range. This is fine since the CLI has its own validation layer, but worth noting the asymmetry.
• draw(-5) also silently returns [] (via range(min(-5, 78)) being empty). Same reasoning applies -- CLI guards against it.
• The test runner's except AssertionError on line 235 would silently swallow test failures if there were a typo, but it's spelled correctly and all tests pass. For future-proofing, pytest compatibility (already works via uv run pytest) is the safer runner.