task: Remove vardot/varbase-patches and the Drupal CMS wiring script from the site template recipe

Problem/Motivation

recipes/horizonaid/composer.json carries "vardot/varbase-patches": "~11.0.0" in its require. That package is a Composer plugin, and a Composer plugin only does anything from the ROOT composer.json: it needs config.allow-plugins and the extra.composer-patches.allowed-dependency-patches allowlist, neither of which a recipe can set for the project that installs it. So requiring it here does not make the patches apply. It only pulls the package in and couples the recipe to a Vardot-specific patch plugin.

The wiring script already does this properly. recipes/horizonaid/scripts/drupal-cms-wiring.php merges scripts/assets/drupal-cms.composer.json into the root composer.json, which sets allow-plugins for cweagans/composer-patches, vardot/varbase-patches and oomphinc/composer-installers-extender plus the default-deny allowed-dependency-patches list, and then tells the user to run composer require vardot/varbase-patches from the project root. That is the only place it works.

Continues #3614681: Add Varbase Patches to the composer requirements and a Drupal CMS wiring script.

Steps to reproduce

1. Look at recipes/horizonaid/composer.json: vardot/varbase-patches is in require.
2. Look at recipes/horizonaid/scripts/drupal-cms-wiring.php and scripts/assets/drupal-cms.composer.json: the allowlist and the root require are already handled there.
3. The recipe's own require adds the package without enabling the plugin, so it is redundant where it sits.

Proposed resolution

MR !57 (merged): drop "vardot/varbase-patches": "~11.0.0" from require in recipes/horizonaid/composer.json. A recipe cannot enable a Composer plugin, so the requirement did nothing where it sat.

MR !58 (merged): remove the wiring script and its composer asset (scripts/drupal-cms-wiring.php, scripts/assets/drupal-cms.composer.json). The script was never run by the recipe itself, only by the "(Drupal CMS) Install Horizon Aid site template" CI job, so that job now does the work directly: nine composer config calls for the plugin allowlist and the patch allowlist, plus the placement the script used to do: it copies scripts/assets/drupal-libraries.package.json into the Drupal CMS root as package.json, writes the .yarnrc.yml that keeps Yarn 4 on the node-modules linker, and copies scripts/drupal-libraries-sync.js in next to package.json where postinstall expects it. The front-end library sync stays in the recipe (both files); the yarn install, the drupal-libraries count assertion and the ls web/libraries steps are unchanged.

Remaining tasks

• ✅ File an issue
• ✅ Remove the requirement from the recipe's composer.json (MR !57, merged)
• ✅ Remove the wiring script and its composer asset (MR !58, merged)
• ✅ Move the Drupal CMS composer setup and the library-file placement into the "(Drupal CMS) Install Horizon Aid site template" CI job (MR !58, merged)
• ✅ Confirm the guarding CI job still passes (pipeline 930491, 26/26 green)
• ✅ Verify a fresh install still works both ways: the browser installer's site template picker and drush site:install. The Varbase 11 install was verified green locally, and the Drupal CMS install CI job passes with the library sync running and 6 libraries declared. The local workspace builder's Drupal CMS path still fails for an unrelated reason, tracked separately.
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release, horizonaid-1.0.0-alpha2

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Removed the vardot/varbase-patches requirement from the site template recipe.
• Removed the Drupal CMS wiring script and its composer asset; the Drupal CMS composer setup and the front-end library-file placement now live in the CI job that installs the site template.

AI-Generated: Yes