capsite/toybox: an OCapN counter vat; no import GC in workerd peers

vats/counter.js keeps its count in the vat's storage; the test checks
that it counts and that two counter vats count apart.

Running it after the greeter test hung: a FinalizationRegistry callback
in the vatAdmin, collecting an import, sent op:gc over the client's
WebSocket, and workerd forbids I/O outside a request. The vatAdmin's and
the vats' OCapN clients now run with enableImportCollection: false, so
imports go when their session does.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/vats/counter.js

@@ -0,0 +1,10 @@
+/** A counter whose count lives in the vat's storage. */
+export const buildRootObject = ({ Far, storage }) =>
+	Far("counterRoot", {
+		increment: () => {
+			const n = (storage.get("count") ?? 0) + 1;
+			storage.put("count", n);
+			return n;
+		},
+		read: () => storage.get("count") ?? 0,
+	});