Migrate kernel to support only subcluster-based vat launch

[sirtimid]

Currently, the kernel supports launching standalone vats via kernel.launchVat, which are not associated with any subcluster. However, with the introduction of the subcluster abstraction, this standalone mode is no longer necessary. A subcluster can simply contain a single vat, which simplifies the model and enforces consistency in configuration and lifecycle management. This aligns with the core purpose of subclusters, coordinated configuration and lifecycle for vats, and avoids the need for special cases like "rogue vats." It simplifies both internal logic and the user-facing model.

Proposed changes:

• Remove support for launching vats outside a subcluster.
• Deprecate or remove the kernel.launchVat method.
• Update all integration tests in @ocap/kernel-test that rely on launching standalone vats.

Ensure the control panel and related tools operate under the assumption that all vats belong to subclusters (even if singular).