don’t save `package.json`

currently, clib(1) doesn’t save it, so we won’t either.  i think a better
(final) approach would be to save dependencies into their own separate
directories (./deps/foo/foo.{h,c}) which will include the package.json
file.
simplify downloading sources
add some temporary logging
add support for dependencies listed in package.json