Implement vat restarts as first-class operation

Requires #229 

Restarting a vat should be a first-class operation in the kernel. By this we mean that you should be able to stop and start the execution of a vat, without losing the identity of the vat or its objects. How restarts relate to distributed objects (ref #29) is outside the scope of this issue.