Use the generator factory for closed initialized random fields

Opt-in modern-.NET port of explicit private non-readonly RNGCryptoServiceProvider fields with a parameterless initializer and no other writes. Require every field reference to be its declaration or a resolved BCL byte-array GetBytes/GetNonZeroBytes call. Use a collision-safe RandomNumberGenerator field and Create() initializer, preserving static/instance initialization, shared reuse, arguments and lifetime. Leave writes/resets, escapes, configuration/identity/cleanup operations, unsupported owners/imports, lambdas/queries and snapshots unchanged. No provider/random-stream identity, reflection/serialization or Framework platform/FIPS policy emulation. No new cleanup policy; standalone, not in version composites.