[Genyus]

The CI setup job's Install dependencies step logged errors for every plugin, but the step still passed. The slides importer's dependencies never installed.

Cause

php-actions/composer runs Composer in its own Docker image, which ignores the PHP from the Setup PHP step. In that container:

• The checkout is owned by the runner user, so git reports "dubious ownership" and Composer can't detect plugin versions.
• npm isn't installed, so cbf-multisite's npm install || true fails silently.
• zip and gd are missing, so composer install fails for cbf-slides-importer (phpoffice packages).

None of this failed the step. install-ssp joins the plugin installs with ;, so its exit status comes from the final cd. The same script runs during the server deploy's composer install, so a failed plugin install there would go unnoticed too.

The cache step saved /tmp/composer-cache, a path that only applied inside the Docker action.

Changes

• CI: run composer install directly on the runner, with zip and gd enabled in setup-php, and cache Composer's actual cache-files-dir.
• composer.json: install-ssp and update-ssp chain commands with &&, so a failed plugin install fails the command (and the CI step or deploy).

Production's command-line PHP has zip and gd loaded, so the stricter chaining shouldn't break deploys there. Staging is on the same host but wasn't checked.

Testing

Locally:

• composer run-script install-ssp exits 0, with no changes to tracked files or the lock file.
• With a stub composer that fails in cbf-slides-importer, the script stops there with error code 1 and skips the remaining plugins.

The workflow parses, and actionlint reports only the existing shellcheck notes on the version job. This PR's own CI run is the first real test of the new step. Expect it to take longer, because the cache starts empty and cbf-multisite's npm install now actually runs.