For the time being, mark sandbox $c0's as storing ephemeral capabilities,
since we will delegate capabilities without the non-ephemeral bit set.
This fixes the problem I was encountering in which CHERI completely
accurately and correctly threw a non-ephemeral capability store exception.

I begin to wonder if the ephemeral bit should be separate from the
permissions mask, as with unsealed, so that it is not manipulated as part
of regular candperm operations, which may otherwise need to effectively
always specify the non-ephemeral bit as being maintained.