capsite/toybox: OCapN vats; createVat takes remote objects

The admin socket now also speaks OCapN over Cap'n Web: a WebSocket there
reaches the VatAdmin DO, an OCapN peer whose bootstrap (swissnum
vatAdmin) offers createVat(src, params). params may hold remote objects;
the vat's root comes back as one.

Each OCapN vat is its own peer: SES and @endo/ocapn run in its facet
(vat-runtime.js, bundled with esbuild), around the vat's own module,
which exports buildRootObject(vatPowers, params). Passing a client's
object to a vat, or a vat's root to the client, is an OCapN handoff, so
the receiver dials the exporter. Nothing here can dial out, so the
VatAdmin is also the router: a client registers its gateway under a
designator, a vat's designator is its id, and every peer reaches every
other through it. The netlayer is ertp-clerk's, made to work over Workers
RPC stubs and plain promises as well as Cap'n Web.

Not yet: sturdyrefs that survive a restart, an adminNode, and grants
(egress, mount) for OCapN vats. App vats (export class App) still work
beside them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/vat-runtime.js

@@ -0,0 +1,51 @@
+/**
+ * @file The runtime of an OCapN vat: SES, an OCapN peer, and the vat's own
+ * module (`vat.js`), which exports `buildRootObject(vatPowers, params)`.
+ *
+ * Bundled (see build.js) and loaded as the facet's main module beside the
+ * vat's code. The vat's designator is its id; it reaches other peers, and
+ * they reach it, through the vatAdmin's router (`env.router`).
+ */
+import "@endo/init";
+import { DurableObject } from "cloudflare:workers";
+import { E, Far } from "@endo/far";
+import { makeClient } from "@endo/ocapn";
+import { makeRpcNetLayer } from "./netlayer.js";
+import * as vat from "./vat.js";
+
+/**
+ * The swissnum of a vat's bootstrap: the vatAdmin starts the vat through it.
+ * Not exported: workerd takes every export of a main module for an entrypoint.
+ */
+const VAT_SWISSNUM = "vat";
+
+export class App extends DurableObject {
+	#gateway;
+
+	constructor(ctx, env) {
+		super(ctx, env);
+		this.#gateway = this.#boot();
+	}
+
+	async #boot() {
+		const { vatId, router } = this.env;
+		let root;
+		const vatPowers = Object.freeze({ E, Far, storage: this.ctx.storage.kv });
+		const bootstrap = Far("vatBootstrap", {
+			start: (params) => {
+				root ??= vat.buildRootObject(vatPowers, params);
+				return root;
+			},
+		});
+		const ocapn = makeClient({ debugLabel: vatId.slice(0, 8), swissnumTable: new Map([[VAT_SWISSNUM, bootstrap]]) });
+		const netlayer = await ocapn.registerNetlayer(
+			makeRpcNetLayer({ designator: vatId, openGateway: (designator) => router.gateway(designator) }),
+		);
+		return netlayer.gateway;
+	}
+
+	/** This vat's OCapN gateway, for the router. */
+	gateway() {
+		return this.#gateway;
+	}
+}