Added Gemfile.lock.
Switched to a fixed list of gems.

The previous mechanism, which would update the list of gems any time configure
was run, was too brittle. Further, despite having --release-build that would use
the bundled gems, no installers used the feature, thereby breaking builds from
a tarball *that bundled the correct gems to use*. Madness.