Add Workflow random streams and read-only detection

[patbeqo]

What changed?

• Added experimental named WorkflowRandomStream instances that are isolated from application randomness and reseeded across Workflow Reset.
• Added Workflow.getRandomStream(String) and WorkflowUnsafe.isReadOnly().
• Added unit and managed dev-server coverage for replay, Reset, Continue-As-New, child and run isolation, read-only contexts, and existing random-stream isolation.

Why?

OpenTelemetry and other integrations need replay-stable entropy without perturbing a Workflow's application random sequence, plus a way to avoid draws where Workflow state cannot be mutated. This is the prerequisite slice for #3046.

Breaking changes?

None. The public APIs are additive and experimental.

Server PR

None.

Test plan

• mise exec -- ./gradlew :temporal-sdk:test --offline
• Managed dev-server Reset and read-only suites
• mise exec -- ./gradlew test --offline
• mise exec -- ./gradlew spotlessCheck
• mise exec -- ./gradlew :temporal-sdk:javadoc --offline

[patbeqo]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33197ee281

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Guard draws from held streams in read-only contexts

When workflow code retains a stream and later calls nextBytes or nextLong from a query, update validator, or another read-only callback, this implementation advances the stream without any read-only check; the only guard is when Workflow.getRandomStream initially acquires it. Such a query therefore mutates workflow state, so subsequent workflow draws depend on whether and how often the query ran and can produce nondeterministic results during replay. Enforce the read-only restriction on every draw, not only during stream lookup.

Useful? React with 👍 / 👎.