lib/package: Ensure destination did is removed on fs.rename failure, to prevent get_latest() from failing thereafter too.