ESM should be a devDependency

[tmcw]

afaict, there's no reason why we need other modules to include esm for runtime's behalf: CJS consumers will get the rollup UMD package, and non-CJS will get the module. We're just using it for tests (and if we switch to TAP, can remove that direct dep too).