use ensure_packages to avaid package conflicts with local site

this introduces a dependency on puppetlabs/stdlib