Is cr_folders the right place to put the package_id? Why not acs_objects? Do only content repository items need to know which package they belong to?
What about the site_nodes / cr_folders situation? The content repository doesn't play nicely with the rest of ACS which is mounted on site nodes. The site nodes data model supports package_id's already...