fix(swingset): comms: deleteKernelMapping might free the object

Just like in `deleteRemoteMapping`, `deleteKernelMapping` needs to mark the
lref for refcount checking, to handle the case where the comms vat imports an
object from the kernel, drops it, and then the kernel drives the retirement
process (with a `dispatch.retireImport`).

packages/SwingSet/src/vats/comms/state.js

@@ -429,6 +429,10 @@ export function makeState(syscall, identifierBase = 0) {
     if (type === 'object') {
       if (isImport) {
         removeImporter(lref, 'kernel');
+      } else {
+        // deleting the upstream/export-side mapping should trigger
+        // processMaybeFree
+        lrefMightBeFree(lref);
       }
     }
   }