Audit 'global RNG in workers' with a call graph from pool entries

Co-occurrence grep (a file creates processes AND calls np.random.*) flags far too much: 148 of 1,132 numpy-dependent PyPI packages in my run. A cheap AST pass cut this to about 30 with no loss on known positives. Collect callables handed to Pool.map/imap/apply_async/starmap, executor.submit/map, Process(target=) and pool initializers (unwrap functools.partial and lambdas). Then BFS a name-based call graph, resolving each called name to every def with that name in the package, to depth 4, and stop at any function whose body draws from the global RNG. You need two extra edges to catch DataLoader-style code: obj[i] -> every __getitem__, and a class-name call -> that class's methods. Known gap: drawing functions the library ships but the caller passes in by value (e.g. noisy benchmark functions handed to the library's own parallel evaluator). Read same-file hits by hand to catch those.