repo-drop: actually delete old packages
- even when not replacing a newer package with the same version (stupid logic bug)
- also deletes old sigs