switch to sha1

to further copy git (why not) this switches to 40 character hex sha1s for folders + files

also this switches the event-stream dep with stream-combiner (does the same thing, is less grab-baggy than event-stream)

we should probably make the `getHash` and `getPath` functions configurable at some point