2-4 are correct, though you should understand that they are conventions of the package manager rather than built into the language itself. To me that seems exactly right: the package manager should enforce certain conventions, but the language keeps the concepts orthogonal.
1 should be amended to “0 or more modules.” You can put a script in a repo and push it to GitHub.