Executor image: move model packages into uv.lock once policyengine bundle gains a datasets-only mode

Follow-up to #609 / #610, blocked on PolicyEngine/policyengine.py#452.

The executor's Modal image now installs its bootstrap packages canonically via uv_sync(frozen=True, --only-group modal-simulation-image), but the country-model packages are still installed by policyengine bundle install (bridged into uv's environment via --venv /.uv/.venv), because the bundle CLI has no datasets-only mode — it cannot lay down certified datasets and the receipt without also managing packages.

Once PolicyEngine/policyengine.py#452 ships:

1. Add a models dependency group in projects/policyengine-simulation-executor/pyproject.toml referencing the existing bot-maintained model pins (policyengine, policyengine-core, policyengine-us, policyengine-uk), included by the image's uv_sync call.
2. Switch the bundle layer to the datasets-only invocation (data + receipt, no packages).
3. Verify via the existing gates: image smoke, staging prewarm, scripted staging deploy, and a state-level calculation.

End state: uv.lock is the sole source of packages in both simulation images; the bundle's role shrinks to certified data. (If #596 — published single-year datasets — lands first, the data layer may shrink further or disappear.)

Wait for PolicyEngine/policyengine.py#452, then inspect projects/policyengine-simulation-executor/pyproject.toml, the existing bot-maintained model pins, and the executor image's uv_sync and bundle layers. Verify the change through the image smoke, staging prewarm, scripted staging deploy, and state-level calculation gates; done means uv.lock owns packages and the bundle installs certified data only.