capsite/toybox: vats with code installed at runtime, on workerd

Each vat is a Durable Object that stores code by hash and runs it as a
facet through the Worker Loader: an empty env, no fetch, storage that
carries over upgrades. Two sockets with no configured address: whoever
starts workerd hands them in (systemd socket activation), so the admin
socket is the authority to install code.

Tests run a real workerd: install, upgrade, isolation between vats, no
fetch, the public port can't install, and code and state survive a crash.
They spawn the package binary rather than the .bin shim, which forks
workerd, so killing the shim orphaned it and the test run never ended.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/systemd/toybox.socket

@@ -0,0 +1,13 @@
+[Unit]
+Description=toybox vats: public port and admin socket
+
+[Socket]
+# order sets the fds: http=3, admin=4 (see toybox.service)
+ListenStream=127.0.0.1:8787
+ListenStream=/run/toybox/admin.sock
+# whoever can open admin.sock can install code
+SocketUser=root
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target