Tidy up gitignore and npmignore
Pin down dependency versions and give github URLs in package.json

Policy on versions: if a package is 0.x, use the exact version,
otherwise use a tilde version, to avoid API
surprises. `readable-stream` needs an extra constraint because it
didn't have `#push` before 1.0.2 (that really ought to have been worth
at least a minor version bump, I reckon.)
Mention official release, now it's released