Detect non-gzipped tar files more reliably

In addition to starting with the string `package/`, they may also start
with a `pax_global_header`, and this is almost certainly an indication
that we are dealing with a tar file.  For example, git adds a global
header with the commit sha when producing archive files.
rename .gitignore when unpacking foreign tarballs

Fix #5658

Note that this doesn't actually *ignore* the files specified by the
.gitignore and/or .npmignore files.  That would likely require removing
them after the fact, as well as all the same logic that exists in
fstream-npm, since tar does not give us a directory listing, and
tarballs may have their files in any random order.
tar.js: Comment should describe why not what
Do not add the directory containing node executable

Adding the directory containing current node executable may lead to run
different executable than original PATH.
See #5876 for details
test lifecycle path modification
add new changelog

To be maintained by publisher, which for now is @othiym23 (THAT'S MEEE).
update changelog for npm@1.4.24
Remove unpublish step from make publish

Doesn't work that way any more anyway
Remove outdated docpublish make target
Add script to output 'v1.4-next' publish tag
Publish with --tag=v1.4-next
Add 'make tag' to tag current release as latest
doc: update version doc to include pre-* increment args
build: explicitly push to a branch
update changelog for npm@2.0.0-alpha.7
2.0.0-alpha.7
tweaks to changelog
you can now pass quoted args to run-script
fstream@1.0.2
lockfile@1.0.0