subprocessing revamp; drop external deps

I don't really need python-sh, and progress reporting seems
to work better with subprocess, so switch to it.
embed tqdm, license is the same.