fix package dependencies to include package names not on the RPP

and neither released nor system dependencies. This addresses #59.

This implies that parsing a single manifest will require a full crawl of the RPP.