registry path for scoped package tarball should include scope subdirectory under dash directory

The JSON sent by `npm publish` contains the property `versions.XXX.dist.tarball` which contains the scope name twice for a scoped package; for example: "http://localhost:15443/@chad/myhowtonpm/-/@chad/myhowtonpm-1.0.0.tgz". The mock registry server attempts to remove the second occurrence of `@scope` from the file path, which causes an error if users try to create another package into which they install the package created in the workshopper using the mock server. The path should be left as-is to match the tarball property in `body.json` so npm can GET it. Removing this code has the additional benefit of fixing a bug on Windows because the regex does not consider backslashes in the path.

See: #68
Fixes: #122
Fixes: nodeschool/discussions#1561
Fixes: nodeschool/discussions#2049

Author: vobarian

lib/registry.js

@@ -195,8 +195,7 @@ function receivePublishPut (req, res) {
     att = att && att.data
     var dir = path.resolve(assetdir, data._id)
     var jsonFile = path.resolve(dir, 'body.json')
-    var tgzDir = path.resolve(dir, '-')
-    var tgzFile = path.resolve(tgzDir, tgzBase)
+    var tgzFile = path.resolve(dir, '-', tgzBase)
 
     if (!att) {
       return _403(req, res, {
@@ -216,7 +215,7 @@ function receivePublishPut (req, res) {
       existing = {}
     }
 
-    mkdirp.sync(tgzDir)
+    mkdirp.sync(path.dirname(tgzFile))
 
     if (existing && existing.time && existing.time[ver]) {
       return _403(req, res, {
@@ -243,7 +242,7 @@ function receivePublishPut (req, res) {
     existing.time.modified = now
 
     try {
-      fs.writeFileSync(tgzFile.replace(/(-\/)@.*?\//, '$1'), att, { encoding: 'base64' })
+      fs.writeFileSync(tgzFile, att, { encoding: 'base64' })
     } catch (er) {
       return _500(req, res, er)
     }