fixes the following:
- package.json in the app root overrides any other declared deps
- modules copied from the topmost-level module directory, from temp
- wildcard versions declared in app/package.json take precidence