ses + @endo/static-module-record (+@babel tree, ~14MB) always install but only serve opt-in lockdown/compartment modes

## Summary

| dep | size | needed by |
|---|---|---|
| @babel/* + @agoric/babel-generator | 8M | @endo/static-module-record |
| ses | 5M | `APPLICATIONS_LOCKDOWN === 'ses'` and compartment mode |
| @endo/static-module-record | 1M | `loaderMode === 'compartment'` |

~14MB in every install, but both consumers are non-default modes:

- `security/jsLoader.ts:62` — `require('ses')` only when the lockdown mode is `'ses'` (the default is `freeze-after-load` using in-tree `freezeIntrinsics`, per #389).
- `security/jsLoader.ts:699` — `@endo/static-module-record` is already a lazy `await import()` inside `getCompartment`, reached only when a scope sets `loaderMode: 'compartment'` (the default loader is vm-based, per #121).

Proposal: move `ses` and `@endo/static-module-record` to `optionalDependencies` (or optional peers), and fail the two opt-in modes with an actionable error when the module is absent. Default installs drop ~14MB; anyone using the SES modes installs them explicitly.

Compartment mode is **not** removable — #756 plans the SES Compartment as the determinism contract for workflow code — so this is strictly an optionality change: the mode keeps working when the dependency is present, and the error message tells you what to install when it isn't. If #756 later makes compartments a default-on path, this issue inverts and the deps go back to hard `dependencies` — worth a note on that decision.

## Method

`npm install harper@5.2.7 --omit=dev` on darwin/arm64, npm 11.16.0; per-package `du -sm`. Mode gating read directly from security/jsLoader.ts (lines 60–78, 91–98, 698–700).

## References

- #121 — vm-based loader decision
- #389 — freeze-after-load default
- #756 — SES Compartment policy for workflow determinism (the future consumer)
- #2164 — install footprint umbrella (part of lever 4)

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start with the mode-gating paths in security/jsLoader.ts, especially lines 60–78, 91–98, and 698–700, then inspect the package dependency declarations for ses and @endo/static-module-record. The change is done when default installs omit these packages, both opt-in modes still work when dependencies are present, and missing modules produce actionable installation errors.

Written by the indexing model from the issue text.