capsite/toybox: an OCapN counter vat; no import GC in workerd peers

vats/counter.js keeps its count in the vat's storage; the test checks
that it counts and that two counter vats count apart.

Running it after the greeter test hung: a FinalizationRegistry callback
in the vatAdmin, collecting an import, sent op:gc over the client's
WebSocket, and workerd forbids I/O outside a request. The vatAdmin's and
the vats' OCapN clients now run with enableImportCollection: false, so
imports go when their session does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/test/ocapn.test.js

@@ -66,3 +66,14 @@ test("createVat passes a remote object in; the vat's root comes back", async ()
 	assert.equal(await E(root).hello(), "hello from the vat");
 	assert.equal(await E(root).greetVia("vat"), "hi vat, from carol");
 });
+
+test("a counter vat counts; two counter vats count apart", async () => {
+	const src = await vatSrc("counter.js");
+	const { root: a } = await E(client.vatAdmin).createVat(src);
+	const { root: b } = await E(client.vatAdmin).createVat(src);
+	assert.equal(await E(a).increment(), 1);
+	assert.equal(await E(a).increment(), 2);
+	assert.equal(await E(b).increment(), 1);
+	assert.equal(await E(a).read(), 2);
+	assert.equal(await E(b).read(), 1);
+});