[bigdubs]

we use `govendor` to inline dependencies in tree; removes npm as a critical path when deploying, also means we can review dependency code changes like normal code changes.