efficiently validate tmp tarballs safely

Only validate tarballs when necessary, validate them locally, and make
sure that each one that's being validated is being unpacked to a
different directory. Fixes #6329.
logging cleanup
style tweaks
standardize how a cached package root is named