use cmspm from pkgtoools instead of cmsdist; make use of cms-sparse-checkout to get sources for patch releases