Define explicit subcluster lifecycle

[rekmarks]

We need to define the subcluster lifecycle. How is it born? How does it die? Which errors in which vats should cause the subcluster to terminate?

Based on recent discussions, we have surfaced a couple of requirements:

• A subcluster must install cleanly; the config must be valid and all bundles must be retrieved
• The subcluster's lifecycle is coterminous with the bootstrap vat; if the bootstrap vat dies, it takes the subcluster along with it
  • Per below, this is not true for non-bootstrap vats.
• The bootstrap vat should receive promises for the root objects of its sibling vats
• The bootstrap vat is responsible for handling startup / lifecycle failures of its sibling vats
  • The bootstrap vat should receive a function for terminating its subcluster