refactor: Genericize system-only service error

[rekmarks]

Genericizes the error message when a user subcluster requests a system-only service to conceal system internals.

---

Note

Low Risk
Small behavior change limited to error messaging in service validation; core launch logic and authorization semantics remain the same.

Overview
User subclusters that request a systemOnly kernel service now fail with the same no registered kernel service '<name>' error used for unknown services, instead of a distinct "restricted to system subclusters" message.

Updates SubclusterManager service validation and adjusts the corresponding unit test expectation to match the new generic error.

^{Written by Cursor Bugbot for commit fcfa449. This will update automatically on new commits. Configure here.}

[FUDCo]

Mahvelous!

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	77.85% ⬇️ -0.01%	6284 / 8071
🔵	Statements	77.81% ⬇️ -0.01%	6385 / 8205
🔵	Functions	75.82% 🟰 ±0%	1581 / 2085
🔵	Branches	77.78% ⬇️ -0.01%	2318 / 2980

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/ocap-kernel/src/vats/SubclusterManager.ts	97.43% ⬇️ -0.04%	91.11% ⬇️ -0.19%	100% 🟰 ±0%	97.39% ⬇️ -0.04%	203, 269, 275-277

Generated in workflow #3716 for commit fcfa449 by the Vitest Coverage Report Action