Challenge 2 — Solution

Task: Write a composer.json with both a "require" entry for a
hypothetical package "acme/mailer" version ^3.0, and a "require-dev"
entry for "phpunit/phpunit" version ^10.0. Add a "scripts" section with
a "test" shortcut running phpunit. Explain in a comment what command
would install only the production dependencies, skipping require-dev
entirely.

---- composer.json ----

{
    "require": {
        "acme/mailer": "^3.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^10.0"
    },
    "scripts": {
        "test": "phpunit"
    }
}

---- Comment: installing only production dependencies ----

    composer install --no-dev

This installs every package listed under "require" (acme/mailer and
anything it depends on) but skips everything under "require-dev"
entirely - phpunit/phpunit would never be downloaded onto a server
running this command, matching the chapter's own guidance that a
production deployment has no reason to install developer-only tooling.

Notes:
- "acme/mailer": "^3.0" would accept 3.0.0 or higher, up to (but not
  including) 4.0.0 - the same caret-constraint reasoning from Challenge
  1, applied to a real dependency entry.
- The "scripts" section's "test" key means running "composer test"
  from the command line executes "phpunit" - a shorter, memorable
  command that every contributor to this project can rely on without
  needing to remember the exact vendor/bin/phpunit path.
- composer install --no-dev is specifically the command a real CI/CD
  pipeline or production deployment step would run, exactly matching
  the chapter's own "require-dev / --no-dev" quick-reference line.