Commit the Lockfile: Use composer install in CI for Deterministic PHP Deploys
Commit composer.lock for apps and run composer install in CI. Update locally to move constraints, install everywhere else to reproduce the exact dependency graph with Composer 2.