minor fixes
check shas
Check shas on the way out, ensure binary atts

Somehow we were getting strings out of
level, even though we put in buffers. Apparently
you have to specify both asBuffer and valueEncoding.

Also the URLs cannot be derived consistently from the
package+version; you have to just ask skimdb
where it thinks the tarball lives.

It works now, and for the record I didn't even see
any warnings about sha1sum errors.