npm: enable pinning subdependencies to github tarballs

also some minor reorg