update builder (and fix associated tests)
remove .addLookup() from component-build(1), now performed in Builder
add Package#url() default of first remote

really we should probably do some lookups to discover which is the real
remote anyway