Switch manifests to gzipped msgpack instead of JSON

This is smaller, faster, and vaguely future-proofed, since the gzip
container a) has a magic number we can sniff and b) identifies its
contents by name.