self-update: replace bsdtar with npm tar.gz package, as that doesn't die horribly when encountering a symlink on windows