fix(vats): don't give all of bankManager to 1 account (#9354)

refs: #9342, #9193
stacked on

 - #9353

## Description

Provide localchain accounts only with the `bank` for the relevant
address, rather than giving them access to all accounts in the form of
the `bankManager`.

earlier discussion:
https://github.com/Agoric/agoric-sdk/pull/9342/files#r1594791187

### Security Considerations

bankManager was excess authority

### Scaling / Documentation / Testing Considerations

Nothing significant: no scaling changes; existing docs/tests suffice.

### Upgrade Considerations

code is not released / deployed

packages/vats/src/localchain.js

@@ -6,12 +6,19 @@ import { AmountShape } from '@agoric/ertp';
 const { Fail } = assert;
 
 /**
- * @import {BankManager} from './vat-bank.js';
+ * @import {BankManager, Bank} from './vat-bank.js';
  * @import {ScopedBridgeManager} from './types.js';
  */
 
 /** @import {TypedJson, ResponseTo} from '@agoric/cosmic-proto'; */
 
+/**
+ * @typedef {{
+ *   system: ScopedBridgeManager;
+ *   bank: Bank;
+ * }} AccountPowers
+ */
+
 /**
  * @typedef {{
  *   system: ScopedBridgeManager;
@@ -34,7 +41,7 @@ const prepareLocalChainAccount = zone =>
     LocalChainAccountI,
     /**
      * @param {string} address
-     * @param {LocalChainPowers} powers
+     * @param {AccountPowers} powers
      */
     (address, powers) => ({ address, ...powers, reserved: undefined }),
     {
@@ -50,12 +57,11 @@ const prepareLocalChainAccount = zone =>
        * @param {Payment} payment
        */
       async deposit(payment) {
-        const { address, bankManager } = this.state;
+        const { bank } = this.state;
 
         const allegedBrand = await E(payment).getAllegedBrand();
-        const bankAcct = E(bankManager).getBankForAddress(address);
-        const allegedPurse = E(bankAcct).getPurse(allegedBrand);
-        return E(allegedPurse).deposit(payment);
+        const purse = E(bank).getPurse(allegedBrand);
+        return E(purse).deposit(payment);
       },
       /**
        * Execute a batch of transactions and return the responses. Use
@@ -118,7 +124,8 @@ const prepareLocalChain = (zone, makeAccount) =>
         const address = await E(system).toBridge({
           type: 'VLOCALCHAIN_ALLOCATE_ADDRESS',
         });
-        return makeAccount(address, { system, bankManager });
+        const bank = await E(bankManager).getBankForAddress(address);
+        return makeAccount(address, { system, bank });
       },
       /**
        * Make a single query to the local chain. Will reject with an error if