capsite/toybox: vats with code installed at runtime, on workerd

Each vat is a Durable Object that stores code by hash and runs it as a
facet through the Worker Loader: an empty env, no fetch, storage that
carries over upgrades. Two sockets with no configured address: whoever
starts workerd hands them in (systemd socket activation), so the admin
socket is the authority to install code.

Tests run a real workerd: install, upgrade, isolation between vats, no
fetch, the public port can't install, and code and state survive a crash.
They spawn the package binary rather than the .bin shim, which forks
workerd, so killing the shim orphaned it and the test run never ended.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/systemd/toybox.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=toybox vats (workerd)
+Requires=toybox.socket
+
+[Service]
+ExecStart=/opt/toybox/node_modules/workerd/bin/workerd serve --experimental /opt/toybox/config.capnp -S http=3 -S admin=4 -d state=/var/lib/toybox
+DynamicUser=yes
+StateDirectory=toybox
+# no network but the sockets handed in
+PrivateNetwork=yes
+RestrictAddressFamilies=AF_UNIX
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+SystemCallFilter=@system-service
+# not MemoryDenyWriteExecute: V8's JIT needs W+X

toybox/systemd/toybox.socket

@@ -0,0 +1,13 @@
+[Unit]
+Description=toybox vats: public port and admin socket
+
+[Socket]
+# order sets the fds: http=3, admin=4 (see toybox.service)
+ListenStream=127.0.0.1:8787
+ListenStream=/run/toybox/admin.sock
+# whoever can open admin.sock can install code
+SocketUser=root
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target