Add Varbase Canvas Base recipe

Problem/Motivation

The Drupal Canvas module installs now live in the new Varbase Canvas Base recipe (#3620177, merged, 1.0.x-dev released and packaged). Nothing applies that recipe yet, so canvas_override would stop being installed the moment #3620192 removes it from Varbase Content Base.

Steps to reproduce

1. Read recipe.yml: the recipes: list does not include varbase_canvas_base.
2. Read composer.json: drupal/varbase_canvas_base is not required.
3. Merge #3620192 alone and run a fresh install: canvas_override is no longer enabled.

Proposed resolution

Add the recipe to the applied list and require it:

• recipe.yml: add varbase_canvas_base to recipes:, immediately after varbase_users_base. It goes early because Varbase Admin Base, Media Base and Content Base all sit later in the list and expect Drupal Canvas to be present, and because the roles the Canvas permissions attach to are created by varbase_users_base.
• composer.json: add "drupal/varbase_canvas_base": "~1.0.0".

Varbase Starter is the only recipe that applies Varbase Canvas Base. The Vardot site templates (Educare, Horizon Aid, RightUp) deliberately do not: they apply Varbase Content Base and Varbase Media Base directly, the canvas module install stays in Varbase Media Base, and the Drupal Canvas permission grants stay in Varbase Content Base, so those three are unaffected by this change.

canvas_icon_picker is untouched here — it belongs to Varbase Admin Base, per #3620064 and #3620066.

Ordering. Merge this before, or together with, #3620192. Merging #3620192 first leaves a window where a fresh Varbase Starter build installs no canvas_override.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• None. The same modules end up installed and the same roles hold the same permissions as before.

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• Varbase Starter now applies the Varbase Canvas Base recipe, which owns the Drupal Canvas and Canvas Override module installs.

AI-Generated: Yes