(PUP-3604) Rework handling of :ensure with a version

Speaking as one who is ignorant of OpenBSD ways, why? Are we calling a different command?