package: use npm ci, remove npm dedupe

`npm ci` does not modify the package-lock.json file, which is exactly what we want during packaging time. Otherwise, on Windows, npm will attempt to remove the mac-only dependencies like appdmg from package-lock.json.

bin/package.js

@@ -39,8 +39,8 @@ const argv = minimist(process.argv.slice(2), {
 function build () {
   console.log('Reinstalling node_modules...')
   rimraf.sync(NODE_MODULES_PATH)
-  cp.execSync('npm install', { stdio: 'inherit' })
   cp.execSync('npm dedupe', { stdio: 'inherit' })
+  cp.execSync('npm ci', { stdio: 'inherit' })
 
   console.log('Nuking dist/ and build/...')
   rimraf.sync(DIST_PATH)