appimage: copy the path-repo bundle into vendor/ instead of symlinking

The Makefile's appimage target ran composer install with the path repo
configured as `"symlink": true`. Composer created a symlink at
vendor/php-qml/bridge → <BUNDLE_ABS>. rsync into the AppDir preserved
the symlink, whose target path doesn't exist on the user's machine.

At runtime: Caddy + frankenphp boot fine, /healthz returns 200 (no
bundle services touched), but every API request fails with:

  Warning: include(.../symfony/vendor/composer/../php-qml/bridge/src/
  BridgeBundle.php): Failed to open stream: No such file or directory

…and the migrations step fails identically on first launch.

COMPOSER_MIRROR_PATH_REPOS=1 is the documented env-var lever, but
explicit `"symlink": true` in composer.json takes precedence over it
(verified the env var alone leaves the symlink in place). Dropping the
env var; instead, sed the symlink option to `false` in the staging
composer.json, alongside the existing URL rewrite.

Composer.json source-of-truth keeps `symlink: true` so dev-mode
installs are still hot-reloadable against framework/php source. Only
the staging copy used for AppImage assembly is mirrored.

Verified locally: `vendor/php-qml/bridge` is now a real directory after
composer install; `BridgeBundle.php` exists as a regular file.

Note for follow-up (out of scope here): perfsmoke didn't catch this
because /healthz doesn't touch any BridgeBundle services. Worth
extending perfsmoke to also exercise an actual API endpoint so packaging
regressions of this shape fail loudly in CI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

examples/todo/Makefile

@@ -54,9 +54,12 @@ appimage: build ## Package as a single-file Linux AppImage at build/Todo-x86_64.
 		--exclude='var/cache/' --exclude='var/log/' \
 		$(SYMFONY_DIR)/ build/staging-symfony/
 	# Rewrite the path repo to absolute so composer can find the bundle
-	# from the staging dir (different relative depth than the source tree).
+	# from the staging dir, AND flip symlink:true → false so composer copies
+	# the bundle into vendor/ — symlinks would survive the rsync into the
+	# AppDir but their targets wouldn't exist on the user's machine.
 	BUNDLE_ABS="$$(cd $(SYMFONY_DIR)/../../../framework/php && pwd)"; \
 	    sed -i "s|\"../../../framework/php\"|\"$$BUNDLE_ABS\"|" build/staging-symfony/composer.json
+	sed -i 's|"symlink": true|"symlink": false|' build/staging-symfony/composer.json
 	rm -f build/staging-symfony/composer.lock
 	cd build/staging-symfony && composer install --no-dev --no-interaction --classmap-authoritative
 	../../packaging/linux/build-appimage.sh \