refactor(ocap-kernel): give KernelRouter's constructor an options bag

[sirtimid]

Stacked on #1099, and last in the chain on purpose: three PRs were editing
KernelRouter.ts and this would have conflicted with all of them.

KernelRouter's constructor had grown to six positional parameters — four of
them functions, two of those taking a vat id and returning a promise. CLAUDE.md
asks for an options bag past two arguments. It is now one, shaped like
SubclusterManagerOptions and VatManagerOptions in the same package.

No behaviour change, and KernelRouter is not exported from the package's entry
points, so there is nothing for a consumer to notice: no-changelog.

Changes

• KernelRouterOptions, and a destructured constructor.
• The three call sites: Kernel.ts and two test files.

Testing

The evidence that this is a move is that the tests are untouched apart from the
call-site shape: same it/describe counts, same titles, one diff hunk per
file, confined to the new KernelRouter(...) expression. The whole
@metamask/ocap-kernel suite passes unchanged.

No new tests, deliberately. Every cross-type mis-binding is already a compile
error on the branded id types; the one type-legal swap, restartVat against
terminateVat, is caught by the existing restartVat and terminateVat
describes in KernelRouter.test.ts. A new test would double-guard the one
guarded thing.

Two things I checked rather than assumed, both worth recording:

A bag does not make the wiring safer here. I had expected named fields to
prevent silently swapping restartVat and terminateVat; they do not. The two
signatures are mutually assignable — reason being optional keeps the required
arity at 1 either way — so the swap compiles positionally and in the bag alike.
This PR is a readability and convention fix, not a type-safety one.

logger is a gap the bag's shape can reach. It is optional, so deleting
logger: this.#logger from Kernel.ts compiles and the whole suite still
passes — and the router's warn on a skipped delivery is the only trace of an
endpoint that has quietly stopped listening. It is wired correctly here and the
same hole existed for the positional seventh argument, so this is not a
regression; but it is the mistake this kind of conversion invites, and nothing
would catch it. Worth a test on Kernel's side, which is not this PR.

🤖 Generated with Claude Code

---

Note

Low Risk
Mechanical API refactor with unchanged runtime behavior; KernelRouter is internal to the package.

Overview
Refactors KernelRouter construction from six positional arguments (four callbacks plus optional logger) to a single KernelRouterOptions object, matching patterns like VatManagerOptions and SubclusterManagerOptions.

Call sites in Kernel, KernelRouter.test.ts, and KernelRouter.remote-gc.test.ts now pass named fields (getEndpoint, invokeKernelService, restartVat, terminateVat, logger, etc.) instead of ordered parameters. No routing or delivery behavior changes—only constructor wiring and JSDoc.

^{Reviewed by Cursor Bugbot for commit 912c82b. Bugbot is set up for automated code reviews on this repo. Configure here.}