capsite/toybox: ingress is a capability; a hello-world web vat

E(vatAdmin).makeIngress(labels) reserves a mount and returns an ingress;
whoever holds it serves requests carrying those labels by calling
E(ingress).serve(handler). A vat gets one in its params, like any other
remote object; nothing in a vat's module is an entrypoint. A request
reaches the handler as passable data (method, path, labels, body), and
the response comes back as data (status, headers, body). The handler is
a live reference for now: after a restart its mount answers 503.

vats/hello.js serves hello, world; pnpm hello creates it on a running
toybox (client.js is the Node OCapN client, shared with the tests).

pnpm start and pnpm switchboard never ran: systemd-socket-activate wants
absolute paths for unix sockets.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/scripts/hello.js

@@ -0,0 +1,19 @@
+/**
+ * @file Create the hello-world vat on a running toybox and mount it.
+ *
+ * Usage: node --import ./test/lockdown.js scripts/hello.js [name]
+ * then visit http://127.0.0.1:8787/?vat=<name> (default name: hello).
+ */
+import { readFile } from "node:fs/promises";
+import { E } from "@endo/far";
+import { connectClient } from "../client.js";
+
+const name = process.argv[2] ?? "hello";
+const client = await connectClient("admin.sock", `hello-script-${process.pid}`);
+try {
+	const ingress = await E(client.vatAdmin).makeIngress({ vat: name });
+	const { id } = await E(client.vatAdmin).createVat(await readFile("vats/hello.js", "utf8"), { ingress });
+	console.log(`vat ${id}\nhttp://127.0.0.1:8787/?vat=${name}`);
+} finally {
+	client.close();
+}