already installed. If we don't get rid of the old theme, we'll have junk
files accumulating that cause major problems.
Keep track of what "packages" are included in an SMZIP, and offer
to remove them when the SMZIP is installed. Don't derive it at extraction
time; this way, we can still create "overlay" SMZIPs.
Make sure we don't do anything stupid if something malicious like "..\..\.."
is listed as a package name.