capsite/toybox: an OCapN counter vat; no import GC in workerd peers

vats/counter.js keeps its count in the vat's storage; the test checks
that it counts and that two counter vats count apart.

Running it after the greeter test hung: a FinalizationRegistry callback
in the vatAdmin, collecting an import, sent op:gc over the client's
WebSocket, and workerd forbids I/O outside a request. The vatAdmin's and
the vats' OCapN clients now run with enableImportCollection: false, so
imports go when their session does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/supervisor.js

@@ -201,7 +201,14 @@ export class VatAdmin extends DurableObject {
 				return harden({ id: id.toString(), root });
 			},
 		});
-		this.ocapn = makeClient({ debugLabel: VAT_ADMIN, swissnumTable: new Map([[VAT_ADMIN, vatAdmin]]) });
+		// workerd runs FinalizationRegistry callbacks outside any request, where
+		// sending the resulting GC message is forbidden I/O. So imports are
+		// never collected here; they go when their session does.
+		this.ocapn = makeClient({
+			debugLabel: VAT_ADMIN,
+			swissnumTable: new Map([[VAT_ADMIN, vatAdmin]]),
+			enableImportCollection: false,
+		});
 		const netlayer = await this.ocapn.registerNetlayer(
 			makeRpcNetLayer({ designator: VAT_ADMIN, openGateway: (designator) => this.gateway(designator) }),
 		);