wf_agent is opaque and owns its XRPC clients, so the settings added for consoles in #13 were unreachable through it — making the whole high-level API unusable on any platform without a system trust store or a usable entropy source. The settings are remembered on the agent rather than applied once, because the chat-service client is created lazily on first chat.bsky.convo use and would otherwise fall back to library defaults for a different host over the same transport. wf_agent_set_tls_rng installs nothing on failure, so the agent is never left with some clients using the application's RNG and others not.