fix(ocap-kernel): finish retiring a vat that is not running

[grypez]

Second of three, stacked on #1029. Splits #1025.

The defect

restartVat stops a vat and then runs it again. A relaunch that fails — the
bundle has moved since the vat was launched, the worker will not spawn — leaves
the vat gone from the running map with its record, its own store and its root
pin all still in place. stopVat(vatId, false) deletes the handle and does not
touch persistence, and nothing puts it back.

Nothing retires a vat in that state. terminateVat goes through stopVat →
getVat and throws VatNotFoundError, so the only way to be rid of one is to
discard the whole store — and terminateSubcluster, which walks persisted
membership rather than the running map, rejects part-way through on reaching
one, after deleting the system-subcluster mapping and before removing the
subcluster record.

Approach

Retiring such a vat does everything stopVat does apart from stopping a worker.
None of it is visible from terminateVat alone, which is why the state was easy
to leave half-done:

• The record goes. markVatAsTerminated alone does not retire a vat: the
  cleanup it schedules walks keys prefixed ${vatId}., which never matches
  vatConfig.${vatId}. Only deleteVat takes that, along with the vat's own
  store and its subcluster membership. A record left behind restores the vat at
  the next boot whose code is reachable.
• The decider promises are rejected, carrying the termination reason.
  cleanupTerminatedVat deletes their c-list entries and drops the decider's
  refcount on the stated understanding that its caller rejected them first.
  Nothing did, so they were left unresolved with a decider that no longer
  existed and no way to ever settle — their waiters hang for good.
• The root pin goes. fix(ocap-kernel): make c-list import accounting symmetric #1020 made launchVat pin a vat's root for its
  lifetime and stopVat release it when terminating, so a vat retired without
  passing through stopVat left its root pinned, and uncollectable, for the
  life of the store.

A vat that is neither running nor persisted still throws.

removeVatFromSubcluster no longer reports a vat that is in no subcluster. It
is reached from deleteVat while a vat is being discarded — the one moment a
failure cannot be retried past — and a vat in no subcluster is already in the
state it asks for.

Relationship to #1023

#1023's #retireVat does the same three things and additionally makes them
atomic, which mine is not, and its stopVat gains the same isVatActive
tolerance. Its version is the better one. If #1023 lands first this PR should be
dropped in favour of it; what may be worth keeping is the exemplary test below,
which drives the state through restartVat rather than constructing it, and the
removeVatFromSubcluster tolerance. Flagging rather than resolving here, since
the two were developed in parallel.

Testing

First commit is the failing repro on its own: 6 tests. The exemplary one,
can be terminated after a failed restart, produces the state the way
production does — run a vat, fail its relaunch, then terminate it — rather than
asserting against a hand-built mock. The rest pin each of the three things a
retire has to do, plus the unknown-vat case as a control.

@metamask/ocap-kernel and @ocap/kernel-test green, with auditRefCounts on
for every kernel kernel-test builds. lint and build clean.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	72.62% ⬆️ +0.08%	9726 / 13392
🔵	Statements	72.47% ⬆️ +0.07%	9889 / 13644
🔵	Functions	73.08% ⬆️ +0.09%	2281 / 3121
🔵	Branches	67.05% ⬆️ +0.16%	4013 / 5985

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/ocap-kernel/src/store/methods/subclusters.ts	98.82% ⬆️ +0.02%	90.62% ⬆️ +0.62%	96.15% 🟰 ±0%	98.78% ⬆️ +0.02%	264
packages/ocap-kernel/src/vats/VatManager.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%

Generated in workflow #4695 for commit 6819b5d by the Vitest Coverage Report Action

[sirtimid]

#1093 re-lands this fix as part of the split of #1021–#1023 into small single-defect PRs, routing it through stopVat — which now tolerates a missing handle — rather than a separate #retirePersistedVat branch, so a running vat and a persisted one are retired by the same path. It carries over your defect narrative, your removeVatFromSubcluster change and its test, and all five of your "persisted but not running" cases. Leaving this open for you to close or to object on #1093.