Document that shrinkwrap still needs package.json