efficiently validate tmp tarballs safely

Only validate tarballs when necessary, validate them locally, and make
sure that each one that's being validated is being unpacked to a
different directory. Fixes #6329.
logging cleanup
style tweaks
standardize how a cached package root is named
doc: build partial html content as well as full-baked pages

The better to docs.npmjs.com for great good
fs-write-stream-atomic@1.0.2

Now works with streams1 fs.WriteStreams.
convert lib/utils/tar.js to use atomic streams
work around nock's use of setImmediate for 0.8
npm-registry-couchapp tests don't work with 0.8

oh well
move locks back into cache, now path-aware

Since there may be multiple locks for a given packages (in different
places), flip the order to make it clearer to debuggers where the lock
came from.  Also wrote a very basic test of locker just so we notice if
it spontaneously breaks.
normalize-package-data@1.0.3

Don't prune bundledDependencies (closes #6282).
shh little test, be quiet
update changelog for npm@2.1.2
2.1.2