capsite/toybox: an OCapN counter vat; no import GC in workerd peers

vats/counter.js keeps its count in the vat's storage; the test checks
that it counts and that two counter vats count apart.

Running it after the greeter test hung: a FinalizationRegistry callback
in the vatAdmin, collecting an import, sent op:gc over the client's
WebSocket, and workerd forbids I/O outside a request. The vatAdmin's and
the vats' OCapN clients now run with enableImportCollection: false, so
imports go when their session does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/vat-runtime.js

@@ -37,7 +37,14 @@ export class App extends DurableObject {
 				return root;
 			},
 		});
-		const ocapn = makeClient({ debugLabel: vatId.slice(0, 8), swissnumTable: new Map([[VAT_SWISSNUM, bootstrap]]) });
+		// workerd runs FinalizationRegistry callbacks outside any request, where
+		// sending the resulting GC message is forbidden I/O. So imports are
+		// never collected here; they go when their session does.
+		const ocapn = makeClient({
+			debugLabel: vatId.slice(0, 8),
+			swissnumTable: new Map([[VAT_SWISSNUM, bootstrap]]),
+			enableImportCollection: false,
+		});
 		const netlayer = await ocapn.registerNetlayer(
 			makeRpcNetLayer({ designator: vatId, openGateway: (designator) => router.gateway(designator) }),
 		);