EVALUATION

Ended up being more complicated than this.  The first access to the charset class is from System.initializeSystemClass, while setting up the err and out streams.  If the charset needs to be downloaded, it will happen here.  Unfortunately System isn't initialized yet and the JRE isn't working enough for Kernel to perform the download, so we have a Catch-22.

The simplest fix turned out to be moving the loadLibrary("zip") up a few lines so it was working by the time Kernel needed it, and ensure that Kernel doesn't freak out if System.out or System.err was null.  I then disabled the safety checks that prevented Kernel from being invoked this early in the JRE startup process.  The charsets bundle can now be downloaded when required.
                                     

EVALUATION

Kernel is using FileReader and FileWriter to work with text files in a couple of spots.  Normally this is a sound practice, but it creates a dependency on arbitrary character converters... which are generally not present in the core.  This manifests as a ClassCircularityError, as downloading a bundle causes us to try to load the character converter, which causes us to try downloading the bundle containing it, which causes...

Since the files in question are all plain ASCII, we should be fine to use FileInputStream / FileOutputStream instead of FileReader / FileWriter.