Fixed and deployed — it now uses crypto.randomUUID() with a getRandomValues fallback for older browsers.
Worse than the bug itself: the page claimed it generated UUIDs "with the browser's cryptographic random source", which simply wasn't true. Thanks for catching it.