Kernel code should be more paranoid about type checking w.r.t liveslots

[FUDCo]

May parts of the additions to Kernel, VatSupervisor, and VatHandle introduced by PR #317 were adapted from SwingSet code that does the same job. The SwingSet code includes a great deal more paranoia about run-time parameter type checking of various of the supporting methods and functions which I largely left out of the current implementation in the interest of getting things working more speedily. However, that run-time paranoia is actually a very good idea and we should incorporate such into our own implementation.

[rekmarks]

I agree that we should be paranoid, albeit selectively and with intent. The key is to establish firm type boundaries in our codebase. Inside the type boundary, we have specific types that we can trust. Outside the type boundary, everything is unknown and must be viewed with complete suspicion. In practice, these boundaries tend to be delineated by:

• The file system
• The network
• Processes
• Untrusted code (e.g. vat user code)

Once we have a value of a certain type, we should be able to trust completely that the value will be of that type at runtime. The key is to make certain that this is the case at the point where the value is created, transformed, or narrowed from unknown. Incidentally, this is why we ban any from our types, whose pernicious influence makes it very hard to maintain confidence in the runtime validity of your types.