Use /bin/sh, to avoid reliance on script exec bit

`npm pack` doesn't guarantee preservance of the executable bit of
scripts, when done on Windows. This effects deploy from Windows to
Linux, see https://github.com/strongloop/strong-arc/issues/788

Untested, I spent about 15 minutes trying to figure out how to arrange things so I can execute pkginstall.js, and couldn't figure it out. Still, should work, and be safe under all conditions.

/to @raymondfeng 
/cc @rmg 
Looks like you accidentally moved `var` with the line.. it hoists, it's just ugly.