capsite/toybox: OCapN vats; createVat takes remote objects

The admin socket now also speaks OCapN over Cap'n Web: a WebSocket there
reaches the VatAdmin DO, an OCapN peer whose bootstrap (swissnum
vatAdmin) offers createVat(src, params). params may hold remote objects;
the vat's root comes back as one.

Each OCapN vat is its own peer: SES and @endo/ocapn run in its facet
(vat-runtime.js, bundled with esbuild), around the vat's own module,
which exports buildRootObject(vatPowers, params). Passing a client's
object to a vat, or a vat's root to the client, is an OCapN handoff, so
the receiver dials the exporter. Nothing here can dial out, so the
VatAdmin is also the router: a client registers its gateway under a
designator, a vat's designator is its id, and every peer reaches every
other through it. The netlayer is ertp-clerk's, made to work over Workers
RPC stubs and plain promises as well as Cap'n Web.

Not yet: sturdyrefs that survive a restart, an adminNode, and grants
(egress, mount) for OCapN vats. App vats (export class App) still work
beside them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/config.capnp

@@ -24,19 +24,21 @@ const config :Workerd.Config = (
 
 const supervisor :Workerd.Worker = (
   compatibilityDate = "2026-10-01",
+  # bundled by build.js
   modules = [
-    (name = "supervisor.js", esModule = embed "supervisor.js"),
-    (name = "labels.js", esModule = embed "labels.js"),
-    (name = "capnweb", esModule = embed "node_modules/capnweb/dist/index-workers.js"),
+    (name = "supervisor.js", esModule = embed "dist/supervisor.js"),
+    (name = "vat-runtime.txt", text = embed "dist/vat-runtime.js"),
   ],
   durableObjectNamespaces = [
     (className = "Vat", uniqueKey = "toybox-vat", enableSql = true),
     (className = "Directory", uniqueKey = "toybox-directory", enableSql = true),
+    (className = "VatAdmin", uniqueKey = "toybox-vat-admin", enableSql = true),
   ],
   durableObjectStorage = (localDisk = "state"),
   bindings = [
     (name = "VATS", durableObjectNamespace = "Vat"),
     (name = "DIRECTORY", durableObjectNamespace = "Directory"),
+    (name = "VAT_ADMIN", durableObjectNamespace = "VatAdmin"),
     (name = "LOADER", workerLoader = ()),
     (name = "SWITCHBOARD", service = "switchboard"),
   ],