Use realize package specifier

This moves all of the stating-the-filesystem we do currently deep in cache to determine if an npm arg is a registry name, local tarball or local directory into a module.