Remove drupal/varbase_dev_base from composer.json: a development recipe that is required but never applied

Problem/Motivation

drupal/educare requires drupal/varbase_dev_base in composer.json, but never applies it: varbase_dev_base does not appear in the recipes: list of recipe.yml (24 recipes, none of them this one). It is a development recipe — it installs dblog, views_ui, config_update_ui, devel, sdc_devel and reroute_email.

The result is that every Educare site downloads a development toolchain it never enables:

drupal/varbase_dev_base       1.0.0-rc1
drupal/storybook              1.0.4
drupal/devel                  5.5.0
drupal/sdc_devel              1.0.3
drupal/stage_file_proxy       3.1.6
drupal/reroute_email          2.3.0-rc2
drupal/devel_entity_updates   5.0.0

On a freshly installed Educare site, none of those modules is enabled, which confirms the recipe is never applied.

Beyond the wasted download, varbase_dev_base requires drupal/storybook ~1.0, and that constraint blocks installing the Vardot site templates onto a plain Drupal CMS codebase:

drupal/storybook[1.0.0-alpha1, ..., 1.0.0-beta2] require drupal/core ^9 || ^10
  -> found drupal/core[...] but it conflicts with your root composer.json require (^11.3.10).
drupal/storybook[1.0.0, ..., 1.x-dev] require symfony/css-selector ^4 || ^6 || ^7
  -> found symfony/css-selector[...] but the package is fixed to v8.1.6 (lock file version)
     by a partial update and that version does not match.

A development dependency should not be a hard requirement of a site template that ships to production.

Steps to reproduce

1. Build any Educare 1.0.x site.
2. Inspect composer.lock: drupal/varbase_dev_base, drupal/storybook, drupal/devel, drupal/sdc_devel, drupal/stage_file_proxy, drupal/reroute_email and drupal/devel_entity_updates are all present.
3. Install the site, then check those modules: none of them is enabled.
4. Grep recipe.yml for varbase_dev_base: it is not in the recipes: list.

Proposed resolution

Remove the "drupal/varbase_dev_base" entry from the require section of composer.json. Nothing applies the recipe, so nothing depends on it being installed. A developer who wants the development tooling can require drupal/varbase_dev_base in their own project and apply it explicitly.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ✅ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release

User interface changes

• N/A

API changes

• N/A

Data model changes

• Sites built from Educare no longer download the development packages pulled in by varbase_dev_base. No configuration or content changes, since the recipe was never applied.

Release notes snippet

• Educare no longer requires the Varbase Dev Base recipe, so a site build no longer downloads development-only modules it never enables.