Remove the Varbase Patches requirement and the Drupal CMS wiring script from the recipe

Problem/Motivation

The Educare site template recipe requires vardot/varbase-patches directly in its composer.json:

"vardot/varbase-patches": "~11.0.0",

It was added in #3614680 so a plain drupal/cms build would get the patch set that drupal/canvas needs to resolve, and the constraint was later moved from 11.0.x-dev to the released ~11.0.0 in #3617362.

The requirement is in the wrong place. A Varbase base already carries vardot/varbase-patches, so a project taking drupal/educare on Varbase gets a second constraint pinned on top of the one the distribution already manages. The patch set is a property of the codebase the recipe is installed onto, not of the recipe.

Only the plain Drupal CMS path actually needs it, and that path already runs scripts/drupal-cms-wiring.php, which is where the rest of the patching setup lives (config.allow-plugins, extra.enable-patching, extra.composer-patches.allowed-dependency-patches).

Steps to reproduce

1. Build a Varbase 11 project, which already requires vardot/varbase-patches.
2. Run composer require drupal/educare.
3. The recipe adds a second vardot/varbase-patches constraint on top of the one the distribution manages.

Proposed resolution

Move the requirement from the recipe into the wiring script's composer asset, so it is applied only to a stock Drupal CMS root.

1. composer.json — remove the "vardot/varbase-patches": "~11.0.0", line from require.
2. scripts/assets/drupal-cms.composer.json — add a require block carrying "vardot/varbase-patches": "~11.0.0", merged into the root composer.json by merge_into() in scripts/drupal-cms-wiring.php alongside the allow-plugins and patches allowlist it already sets.
3. scripts/README.md — add the new require line to the "What it sets" list, and correct the paragraph that currently states varbase-patches "arrives as a requirement of this recipe, so it does not need requiring separately".

No CI change is needed. The 🧩 (Drupal CMS) Install Educare site template job runs scripts/drupal-cms-wiring.php on a --no-install drupal/cms build before composer require drupal/educare:@dev --with-all-dependencies, so the requirement lands in the root ahead of resolution and the existing composer show vardot/varbase-patches assertion in .gitlab-ci.yml keeps guarding it.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
  • ❌ Remove the requirement from the recipe composer.json
  • ❌ Add it to scripts/assets/drupal-cms.composer.json
  • ❌ Update scripts/README.md
• ✅ Testing to ensure no regression, including a green pipeline with the Drupal CMS wiring job
• ➖ Automated unit/functional testing coverage
• ❌ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• Composer metadata and documentation only.

Release notes snippet

• vardot/varbase-patches is no longer a requirement of the Educare recipe. On a plain Drupal CMS codebase it is now added by scripts/drupal-cms-wiring.php; on a Varbase codebase the distribution already provides it.

AI-Generated: Yes