serialize shrinkwrap payload in order

JavaScript objects will serialize in an arbitrary key order because key enumeration is not well defined.

To avoid this we sort the keys and create a fresh object in a specific order. v8 will serialize this object in a consistent fashion.

The problem is *probably* caused because `commands.ls` will write keys to the `pkginfo` in arbitrary order based on disk IO latency and such