> we apparently have no "package management theory"

Honestly, I'd like to have a lowest common denominator of "just dump the contents of the tar/zip archive" here.

Only check required would be to ensure you're not overwriting anything.

Dependencies and PATH management etc could be done out-of-band. That way you would not have to re-download stuff at least.