npm ll --depth=0 breaks for deps with deps
only ls -l children when < depth (closes #6311)
.npmignore isn't respected for git repos
clone & checkout instead of archive (fixes #6400)