only validate package_data when it might be used

closes #5046

Now, we may not want these asserts at all, but given the volume of the output of setup, warnings are effectively useless.