I agree with you completely that each package instance should use its own numbering scheme that starts from 1. This is exactly what I did for the bug-tracker. Each bug has both a bug_id, which is the object_id for acs_objects, and a bug_number, which is not a primary key, but is unique when combined with the package_id (which happens to be called project_id in this table). Only the bug_number is exposed in URLs.
Would people agree that this should be the recommended practice?
I'd also very strongly support XML-based export/import scripts, although I know that it's going to be even more painful to get people to keep those in sync than it already is with the upgrade scripts.
Alas, neither of these things are likely to happen any time soon.