Run commands in prefix, not cwd

In general, we should never be relying on {cwd}/package.json.

The current working directory should be used for printing out relative
paths for human consumption, but npm should always walk up the directory
tree to find its working dir for *doing* stuff.

Fix #6059