perf(release): verify selected service receipt once

scripts/release/dependency_install.py

@@ -448,7 +448,7 @@ def install_snapshot(source: Path, expected: str, cookie: Path, cookie_sha: str)
         write_group_file(directory / name, contents[name], mode, group)
     install.exclusive_file(directory / "receipt.json", canonical(receipt), 0o600)
     check_group(directory, receipt)
-    if install.selection() != selected:
+    if install.selection(check_configuration=False) != selected:
         raise DeliveryError("selected binding changed during dependency installation")
     require_stopped()
     for name in sorted(NAMES):

scripts/release/service_install.py

@@ -75,11 +75,16 @@ def previous_batch(target: str, name: str) -> Path:
 
 
 def current_receipt() -> tuple[dict, dict]:
-    selected = install.selection()
+    selected = install.selection(check_configuration=False)
     path = configuration.installed_receipt_path(
         selected["release_id"], selected["configuration_id"]
     )
     installed = configuration.check_installed(path)
+    if install.selection(check_configuration=False) != selected or any(
+        installed[key] != selected[key]
+        for key in ("release_id", "configuration_id", "manifest_sha256")
+    ):
+        raise DeliveryError("selected configuration changed during complete receipt validation")
     hashes = {
         name: installed["configuration_files"][
             str(