better pkg-id check: allow '.' and start with alphanum