random(): per-thread singleton; random_key/random_nonce use it

Each cipher module's random() now returns a thread-local Random that is
created on first use and reused thereafter. Each thread gets its own
OS-seeded generator (own key+nonce), so no locking and no cross-thread
nonce collisions. random_key() and random_nonce() draw from this CSPRNG
instead of secrets.token_bytes, making them as fast as the stream.
Changes made in the aegis256x4.py template and regenerated.

README.md

@@ -128,9 +128,9 @@ Constants (per module): NAME, KEYBYTES, NONCEBYTES, MACBYTES, MACBYTES_LONG, RAT
 
 ### CSPRNG (aeg.random)
 
-Seeded once from the OS, then a deterministic AEGIS keystream: each call increments the nonce, so no output block ever repeats.
+Seeded once from the OS, then a deterministic AEGIS keystream: each call increments the nonce, so no output block ever repeats. random_key() and random_nonce() draw from it.
 
-- ciph.random() -> aeg.random.Random bound to the cipher module
+- ciph.random() -> per-thread aeg.random.Random singleton for the cipher module
 - rng.bytes(n) -> bytearray, rng.into(buf), rng(n)
 
 ### Random-access encrypted files (aeg.raf)