To add another potential mechanism for delivery of randomness:
It appears that with the latest release of ink!, we can now send and execute XCM from smart contracts. I haven’t verified or tried this yet, but it seems reasonable to say we might be able to do a sort of “hybrid” between ideas 2 and 3 above, where we have a sort of ‘XCM subscription’ model where the randomness is dispatched to a smart contract directly, thus not necessarily requiring a runtime upgrade (unless you don’t support contracts).