Tree hashes of builds now ignore package.json

We were finding that npm was inconsistently including various fields (eg
"readme") in package.json, leading to spurious "must update the version
number" errors in publish-release --from-checkout. This should be good
enough, as any actual package change should also have some other file
changed!