Add source-fallback config option to disable/enable fallback on download failure

[kayw-geek]

Background

By default, Composer silently falls back to cloning from source when dist downloads fail. While convenient, this behavior can be problematic in production/CI environments where:

• Unpredictable build artifacts: Source installations include .git directories and other VCS files, causing deployments to fail or behave unexpectedly
• Silent failures: Users have no way to detect when fallback occurs, making issues hard to diagnose

Usage

Config file:

  {
      "config": {
          "source-fallback": false
      }
  }

Command line:

composer install --no-source-fallback
composer update --source-fallback

Environment variable:

COMPOSER_SOURCE_FALLBACK=0 composer install

Behavior

• true (default): Current behavior - fallback to alternative source on failure
• false: Fail immediately if preferred source is unavailable

When disabled and a download fails, Composer will display a clear error message explaining that fallback is disabled, rather than silently trying alternatives.

Changes

• Added source-fallback config option (defaults to true)
• Added --[no-]source-fallback flag to install, update, require, reinstall, and create-project commands
• Added environment variable support (COMPOSER_SOURCE_FALLBACK)
• Added tests for config and download manager behavior

Fixes #4591