ncm-spma functions: fix test for an explicitly defined package version

Annoying bug discovered when starting to make real use of these rewritten functions.
Nothing. When the length is 0, it means that the existing package was created as an empty nlist, meaning no version locking. So this is safe to replace it by the same thing! (we could also do nothing). The main point is that if you don't add this test, you fail to replace an unlocked version if you do a second `pkg_repl()` of the same package.