Define a documented deterministic vat profile

[sirtimid]

Vat confinement is already strong, and better than it is credited for. Endowments are opt-in against a closed allowlist (packages/ocap-kernel/src/vats/endowments.ts:29-73), VatSupervisor.#initVat builds requestedGlobals only from VatConfig.globals and throws on unknown names (VatSupervisor.ts:388-400), with a kernel-level ceiling at :380-386. A vat declaring no globals gets no clock, no RNG and no network — Date.now() and Math.random() throw in its compartment, and fetch additionally requires an explicit host allowlist (:407-418).

The problem is that this is an emergent property of configuration rather than a named, testable thing. "This vat cannot phone home" currently requires reading the config and knowing what the allowlist implies.

Proposed:

• Define a named profile (e.g. deterministic) that forbids every nondeterministic and I/O-capable endowment.
• Add a conformance test asserting that a vat in this profile cannot observe time, randomness, or the network.
• Document the residual sources of nondeterminism that the profile does not eliminate, so the claim is honest:
  • GC and finalization timing is delegated to liveslots (VatSupervisor.ts:365-373)
  • errorTaming: 'unsafe' exposes engine-specific error.stack (packages/kernel-shims/src/endoify.js:11)
  • no metering, so execution is not bounded

This is the difference between a property we can assert and one a reviewer can verify in a single line of config.

Related: bundle content-addressing — "the same code, run deterministically" needs both halves.