Hardening membrane

Hi Alex. This is a support request, not an issue.

I'm thinking of a convenience membrane for [Agoric/Jessie](https://github.com/Agoric/Jessie), that has "interior" and "exterior" graphs, and when objects cross from interior to exterior they are hardened (a la [Agoric/harden](https://github.com/Agoric/harden)). This separation should be transitive over time so that the membrane also wraps interior function returns and exceptions before they escape to the exterior.

Also, when an exterior method captures an interior `this`, it should throw an exception.

In this formulation, I regard global variables/endowments as neither interior nor exterior.

I'm entirely naive in regards to es-membrane. Is there a straightforward way to implement this kind of membrane (with distortions or somesuch)? If so, I would happily use es-membrane to do the work.

Thank you,
Michael.