fix(run-protocol): complete permits for startRewardDistributor, makeAnchorAsset

[dckc]

closes: ##5212

Description / Security Considerations

When we wired up runStake to rewards, we neglected to update the permit of startRewardDistributor to give it access to the runStake creator facet.

Another incomplete permit that came up in testing ( #5062 (comment) ) was makeAnchorAsset. Since it uses mintHolder for the anchor asset, so it needs access the mintHolder installation and to zoe to start a copy of it.

Testing Considerations

These permits used to be tested by vats/test/test-boot.js but since we moved them to packages/run-protocol, they are no longer covered by tests that run in ci.

While these fixes have been tested manually ( #5062 (comment) ) ideally, this PR would include a regression test that runs in ci. Reviewers will please help judge whether it's expedient to proceed without such a test.

[dckc]

Thanks for verifying that it works, @arirubinstein .

@michaelfig , @turadg , I'm still interested in feedback on the testing considerations above.

[turadg]

Reviewers will please help judge whether it's expedient to proceed without such a test.

Do we have a ticket for cleanups we've identified during this bootstrap? I would non-blocking request a) such a ticket and b) that testing this be included.

[dckc]

@turadg and I have plans to work toward such a test on Thu.

[dckc]

Reviewers will please help judge whether it's expedient to proceed without such a test.

Do we have a ticket for cleanups we've identified during this bootstrap? I would non-blocking request a) such a ticket and b) that testing this be included.

well, we have 1 now: #5217

[michaelfig]

LGTM!