capsite/toybox: a grant is an object in env, not the vat's global fetch

A vat's globalOutbound is now always null. A granted host arrives as
env.egress, an Egress the app can hand to whichever of its parts should
have it; as globalOutbound it was ambient to every module in the vat.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/supervisor.js

@@ -7,8 +7,8 @@ const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart
  * Holds the vat's installed code and egress grant; the app facet holds the app's state.
  *
  * Code is stored by hash so the facet can be rebuilt after hibernation or a
- * restart. The app gets an empty `env`; its `fetch` reaches only the host it
- * was granted, if any, through {@link Egress}.
+ * restart. The app's global `fetch` throws; a granted host arrives as
+ * `env.egress`, an {@link Egress} the app can pass along like any object.
  *
  * Each `start` begins a new incarnation, which names the loaded Worker: the
  * same code with a different grant must not share a Worker.
@@ -47,8 +47,8 @@ export class Vat extends DurableObject {
 				compatibilityDate: "2026-10-01",
 				mainModule: "app.js",
 				modules: { "app.js": src },
-				env: {},
-				globalOutbound: egress ? this.ctx.exports.Egress({ props: { host: egress } }) : null,
+				env: egress ? { egress: this.ctx.exports.Egress({ props: { host: egress } }) } : {},
+				globalOutbound: null,
 			}));
 			return { class: worker.getDurableObjectClass("App") };
 		});
@@ -67,8 +67,8 @@ export class Vat extends DurableObject {
 }
 
 /**
- * A vat's `globalOutbound`: its `fetch`, WebSocket upgrades included, reaches
- * the switchboard only for the host in `ctx.props`, which the vat can't set.
+ * A grant of one host: `fetch`, WebSocket upgrades included, reaches the
+ * switchboard only for the host in `ctx.props`, which no holder can change.
  */
 export class Egress extends WorkerEntrypoint {
 	fetch(request) {