Fresh lock-less composer install aborts on a broken dependency-declared patch

Problem/Motivation

A fresh install with no lock -- rm -rf composer.lock patches.lock.json vendor/ && composer install -- aborts on Varbase Project Template 11.0.x. drupal/ai_context declares a patch on drupal/canvas whose file path does not exist, so composer-patches fails with "Failed to open stream". Base cweagans/composer-patches matches ignore-dependency-patches by exact package name at patch-gather time -- before vardot/varbase-patches' wildcard/allowlist runs -- so the broken patch is gathered and kills the build.

Steps to reproduce

1. rm -rf composer.lock patches.lock.json vendor/
2. ddev composer install

Result: "Failed to open stream" on patches/canvas-3575644-string-long-regex-ai-context-item.patch.

Proposed resolution

• Add extra.composer-patches.ignore-dependency-patches: ["drupal/*", "drupal/ai_context"] in root composer.json so dependency-declared patches from drupal/* are skipped at gather time.
• Remove the tracked patches.lock.json (it regenerates cleanly).

Fix in MR !60. Note: a truly lock-less build also needs the mglaman/composer-drupal-lenient plugin bootstrapped (it relaxes drupal/ckeditor_media_resize vs core ~11.4); that is separate from the patch fix above.

Remaining tasks

• ✅ File an issue about this project
• ✅ Addition/Change/Update/Fix to this project
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support on feature change/addition
• ➖ User Guide Documentation support on feature change/addition
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ✅ Update Release Notes
• ✅ Release varbase_project-11.0.5

User interface changes

• N/A

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• N/A