Often when things seem really complicated, I think it's because I must be doing it wrong.
Working on Drupal core since dependencies were removed from git has seemed really fiddly. For a long time I thought I must have missed something, that there was some undocumented technique I wasn't aware of.
But I've asked various people who work on core a lot more than I do, and they've confirmed that what I've been doing is pretty much the way that they do it: