Check that only the vendoring patch contains go.mod/go.sum/vendor changes #1748
Description
Pulling this out from:
A tricky part [...] is identifying the commit in the repo associated with the vendoring patch. Matching against the commit title could work, but might be fragile. Something more stable could be to use a patch number 50 command to get a fixed number, then CI uses that number to selectively apply pre-vendor patch files and also the vendor patch individually.
Maybe we can settle on the first patch always being the vendoring patch, like it is now.