Vendor NPM predictably

This vendors NPM into /app/vendor/npm (instead of an unpredictable `mktmpdir`-created directory), adds it to the `PATH`, and rewrites its wrapper so that it can be executed directly on a dyno.