capsite/toybox: vats with code installed at runtime, on workerd

Each vat is a Durable Object that stores code by hash and runs it as a
facet through the Worker Loader: an empty env, no fetch, storage that
carries over upgrades. Two sockets with no configured address: whoever
starts workerd hands them in (systemd socket activation), so the admin
socket is the authority to install code.

Tests run a real workerd: install, upgrade, isolation between vats, no
fetch, the public port can't install, and code and state survive a crash.
They spawn the package binary rather than the .bin shim, which forks
workerd, so killing the shim orphaned it and the test run never ended.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/config.capnp

@@ -0,0 +1,32 @@
+# toybox: vats whose code is installed at runtime, each a Durable Object facet.
+#
+# Sockets have no address here: whoever starts workerd hands them in
+# (-S name=fd from systemd, or -s name=addr), so holding a socket is the
+# authority it grants. `state` is likewise overridden with -d state=<dir>.
+using Workerd = import "/workerd/workerd.capnp";
+
+const config :Workerd.Config = (
+  services = [
+    (name = "main", worker = .supervisor),
+    (name = "nowhere", network = (allow = [])),
+    (name = "state", disk = (path = "state", writable = true)),
+  ],
+  sockets = [
+    # reach a running vat by name
+    (name = "http", http = (), service = (name = "main", entrypoint = "Public")),
+    # install code into a vat and (re)start it
+    (name = "admin", http = (), service = (name = "main", entrypoint = "Admin")),
+  ],
+);
+
+const supervisor :Workerd.Worker = (
+  compatibilityDate = "2026-10-01",
+  modules = [(name = "supervisor.js", esModule = embed "supervisor.js")],
+  durableObjectNamespaces = [(className = "Vat", uniqueKey = "toybox-vat", enableSql = true)],
+  durableObjectStorage = (localDisk = "state"),
+  bindings = [
+    (name = "VATS", durableObjectNamespace = "Vat"),
+    (name = "LOADER", workerLoader = ()),
+  ],
+  globalOutbound = "nowhere",
+);