VMR validation leg must verify only one `source-manifest.json` record changes at a time

[premun]

We must prevent changes like dotnet/dotnet#4355 where many records changed at the same time.
There's no batched flows so we won't hit this normally and it will catch cases like this one with weird merges.