Use the same version in the lifecycle feature
Don't trust top-level dependencies have been checked

This fixes a really strange bug in the lockfile where we preemptively
said a dependency was checked, but it actually was not.