refactor: Decouple passable stack from lockdown with @endo/harden

[kriskowal]

Refs: #2983
Closes: #1686

Description

The change in #2782 introduces @endo/harden. This change utilizes it in all applicable Endo packages so that they can run without lockdown. This does not completely eliminate a dependency on ses because @endo/errors entrains a dependency on the global assert provided by ses or specifically ses/assert-shim.js.

Security Considerations

This change should have no consequences for the security model of the relevant packages. We do rely on #2782 to preserve the invariant that harden will never be used both before and after lockdown, which it does not absolutely prevent but does strongly discourage.

Scaling Considerations

This increases the size of bundles by the weight of the @endo/harden module. That could be mitigated with a -C bundling condition like -C sessile (facetious) or -C hjs / -C hardenedjs.

Documentation Considerations

Each of the affected packages has a note in its README that it can be used before or after lockdown. Currently, they can only be initialized after lockdown because of top-level harden calls on their module exports.

Testing Considerations

Existing tests cover the post-lockdown case.

• It would make sense to create an environment variable for testing the pre-lockdown initialization behavior and instrumenting the prepare modules to conditionally lockdown. That might imply generally supporting a NO_LOCKDOWN environment variable in @endo/init and @endo/lockdown.

Compatibility Considerations

Apart from increasing bundle sizes, this change should have no effect on backward compatibility.

Upgrade Considerations

None.

[kriskowal]

This is, for now, an abandoned design direction, see #2983