Random.__init__ used _lib.INVALID_DEVID as a default parameter value,
but INVALID_DEVID is only declared in the CFFI cdef inside
`if features["ML_KEM"] or features["ML_DSA"]`. Since default parameters
are evaluated at module import time, any wolfSSL build that lacks both
ML-KEM and ML-DSA (e.g. via USE_LOCAL_WOLFSSL pointing at a custom
build) raises AttributeError on `import wolfcrypt.random`, cascading
into wolfcrypt.ciphers and effectively breaking the entire library.
Hardcode the default to -2, matching the convention already used by
_Hmac._init and AesGcmStream.__init__ (which call wc_HmacInit /
wc_AesInit with -2 directly rather than referencing _lib.INVALID_DEVID).
Add a build-no-pqc GitHub Actions job that builds wolfSSL with
--disable-kyber --disable-dilithium, installs wolfcrypt-py against it
via USE_LOCAL_WOLFSSL, and runs an import-smoke step plus the full
pytest suite. The smoke step is the explicit regression guard: it
imports wolfcrypt.random and instantiates Random(), which would fail
at import time if the default ever again references a CFFI symbol that
is only conditionally declared.
F-2659
ce93174570