Didn't notice it because vendor/ was already populated on my dev
machine, but did notice it in Docker build.
Docker build now consumes devsetup like regular user, so this should
catch future problems.
Remove remaining curl|shit functionality from lazy.sh (no checkout logic
needed anymore).
refs #35