ensure should never write to the manifest

[carolynvs]

https://github.com/golang/dep/blob/master/cmd/dep/ensure.go#L163 is a bug per #404 (comment). dep ensure should never write to the manifest now that it is user managed.

[sdboyer]

Turns out this is making some other changes messy. It's going to put commands in a bit of an inconsistent state, but I think we need to go ahead and do this ASAP. (remove should also be changed, even though that command will go away entirely soon).

[carolynvs]

@sdboyer I'll get this submitted today.