switch to npm-package-arg from whatever that was
opportunistic linting
npm-package-arg@2.0.0
short-circuit local installs but fall back less
read-package-json@1.2.3
dedupe normalize-package-data
fix order dependency in remote git caching

Also add more logging.
simplify use of maybeGithub
fs-vacuum@1.2.1
make gentlyRm safer and tidier

Checks to ensure that it's only reoving files managed by npm, and
uses fs-vacuum to ensure that empty directories are cleand up as it
goes. Maybe slightly overdone.
replace some.js with (Zalgo-safe) async-some@1.0.0
remove redundant stanza

Since the spec is already passed to fs.stat, including the check for the
'local' type in the switch is misleading.
npmconf@2.0.1

There was no npmconf 2.0.0. Don't even ask.
npm-registry-client@3.0.0