Our scripts currently copy the package.json that does *not* have
the expanded semver, so its version is simply "${VERSION}", and NPM
is very much not happy with that. We can just stop copying the
package.json explicitly since it's inside of the bin/ directory.
To install a package, we copied the pacakge to the destination root,
deleted the node_modules folder and then restored just the production
dependencies. Because of how we were using yarn, this meant hitting
the network, which sucks.
Make two changes:
1. Copy over the yarn.lock file we created when we did our initial
restore (e.g from `make ensure`) so yarn can reuse it.
2. Pass --offline to yarn when we do yarn install. Since we already
installed the packages previously (as part of `make ensure`) they will
be present in the cache and hence we do not need network access.
This cuts the time spent in the make install step by half or more.