switch away from npm-cli

[andreineculau]

we've had several issues in the past few years (the most recent one being that npm dedupe breaks the dependency tree, and needs an extra npm install) and now this https://gist.github.com/aeschright/8ed09cbc2a4aee00fcb4ad35086d76a6

i've investigated a contender one year ago - pnpm https://github.com/pnpm/pnpm and the only issues found then were around deps that were relying incorrectly on deps without specifying them in package.json (but work in npm because of the flattening side-effect of its installation algorithm) and around git deps. both of those issues have been fixed afaik, so it should be tested again.

alternatively yarn is second in line, though disk space issues, license, etc issues were flying around, so it also needs proper attention.

other serious contenders?