composer merge + composer patches not playing nicely

[arknoll]

My system information:

• Operating system type: Mac OSX
• Operating system version: Sierra
• BLT version: 8.7.0-beta2

When I run this command on a freshly cloned codebase that includes Lightning as a dependency:

composer install

And I expected this to happen:
Lightning's composer patches to be applied

What actually happens:
They are not applied

See https://github.com/acquia-pso/canary/pull/32#issuecomment-291192345

Example:
See this patch in lightning profile as an example:

"1356276 - Allow profiles to provide a base/parent profile and load them in the correct order":
                "https://www.drupal.org/files/issues/1356276-276-8.2.x.patch"

It includes this change:

--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -298,7 +298,7 @@ services:
       - { name: event_subscriber }
   config.installer:
     class: Drupal\Core\Config\ConfigInstaller
-    arguments: ['@config.factory', '@config.storage', '@config.typed', '@config.manager', '@event_dispatcher']
+    arguments: ['@config.factory', '@config.storage', '@config.typed', '@config.manager', '@event_dispatcher', '@profile_handler']
     lazy: true
   config.storage:
     class: Drupal\Core\Config\CachedStorage

My codebase after a composer install:
core/core.services.yml

  config.installer:
    class: Drupal\Core\Config\ConfigInstaller
    arguments: ['@config.factory', '@config.storage', '@config.typed', '@config.manager', '@event_dispatcher']
    lazy: true

The patches aren't getting applied correctly.