You know what this thread is missing? 2 cents from yours truly!

Perhaps a quick hash/CRC of the filenames of the patches that have been
applied? Should be quick to generated and test, and will tell us
immediately if we need to run again.

+1 from me

My vote is for using a hash for identifying updates in every situation. Preferable to file names or hardcoded version numbers, in my view.