More precise control over Resource staging

For the new patch implementation, I want to be able to fetch and verify all the patches up front, and only after that succeeds, begin unpacking and applying them.

This extracts an `unpack` method from `stage`, so that the three steps can be performed independently.