cache: atomic de-race-ified package.json writing

a. Use a tmp file with the pid, and mv into place
b. Only write it once, use inflight to hop on it if in progress
v1.4.15
wip