refactor: prepare for non-trapping integrity trait

[erights]

Closes: #XXXX
Refs: Agoric/agoric-sdk#10795

Description

Prepare for anticipated introduction and use of the non-trapping integrity trait as explained at https://github.com/endojs/endo/blob/b12eb434b6672f0ceae41be55aac7f24c4562b7b/packages/ses/docs/preparing-for-stabilize.md

These preparations must work now, before these traits are introduced, and should continue to work after these traits are introduced and used.

Security Considerations

Some things that had been deeply frozen automatically by harden are now manually frozen by explicit calls to freeze. We need to review these carefully to ensure that nothing has inadvertently be left unfrozen as a result of the changes in this PR.

Some proxies will become unhardenable, but they will still be hardenable as of now, so mistaken hardenings will not be detected.

Scaling Considerations

For this PR by itself, none. Using the shim-based implementation of the non-trapping trait will have scaling consequences: #2675

Documentation Considerations

https://github.com/endojs/endo/blob/b12eb434b6672f0ceae41be55aac7f24c4562b7b/packages/ses/docs/preparing-for-stabilize.md will need to be reflected in developer docs.

Testing Considerations

Since this PR by itself should be a pure refactor with no observable changes, there is nothing to test at this stage. The testing burden will come with #2675 to see how adequate these preparations were.

Compatibility Considerations

The point. This changes to coding patterns that should be compat both with the current status quo and with #2675

Upgrade Considerations

As a pure refactor, none.

[mhofman]

Reading this and thinking through the implications, I have concerns we may be painting ourselves in a corner. Our recommendation is that one should harden values before passing them around. That implies we will never be able to use a Proxy as a remotable value. Is that something we're ok with? I know you have reservations with using O style objects as presences, but I'm a little worried about forever closing the door to this possibility.

[erights]

ping

[erights]

Reviewers: I claim that this PR by itself prior to the introduction or use of the non-trapping or stabilize integrity traits is a pure refactor, i.e., it should not produce any observable changes. Please review with that claim in mind. If you do spot something that looks like an observable change, please let me know. Thanks!

[michaelfig]

Please consider my suggestion for reducing some TODOs.

[michaelfig]

LGTM after these two suggestions, which I expect you'll address somehow before merging.

[michaelfig]

Suggested change

	* Local alias of `harden` to eventually be switched to whatever applies
	* Local alias of `freeze` to eventually be switched to whatever applies

[michaelfig]

Suggested change

	const makeInput = () => freeze({ __proto__: mercurialProto });
	const makeInput = () => freezeToBeSuppressTrapping({ __proto__: mercurialProto });