Verify `composer.lock` checksum before deploying `vendor.tgz`

[Kevinjil]

Issues with the vendor lib deployment are very annoying to debug.
The deployment was missing 1 commit touching the composer.lock, hence invalidating the tgz.
Check expected lock file is there before uploading and unpacking.