The service notify API requires Rx to implement sensibly, so just make
it a fixed dependency. Any service which isn't providing notify/v2
probably should be.

Now I have a means of generating correct package-lock files, we should
be committing them to the repo.

This should prevent incorrect package-lock files from being produced.

There is no good idiom in Javascript for 'copy this object without this
key'.

Refactor using Optional and a function from Session to Observable to
avoid needing to pass the Session around.

I don't like this API design; smashing more and more into a set of
function arguments isn't a good idea.

This makes sure we use a configured local npm registry where
appropriate.

* Minor tweaks.
* Comments for the Rx code.