fix: #3620177 Do not grant permissions in the Varbase Canvas Base recipe

Follow-up on #3620177, on top of !1 (merged).

Problem

!1 (merged) moved the 17 Drupal Canvas permission grants out of varbase_content_base and into this recipe. That was wrong, and it would have been a regression in three shipped products.

Educare, Horizon Aid and RightUp apply varbase_content_base directly, not through varbase_starter, and they deliberately do not require this recipe. Each of them carries 58-80 canvas.component / canvas.content_template config keys, so their editors need those grants. Had varbase_content_base stopped granting them while only varbase_starter applied this recipe, all three would have lost create canvas_page, edit canvas_page, administer components, administer patterns and edit canvas global regions.

Resolution

Permissions stay with the recipe that owns the roles they belong to. A Canvas page is content and those are content roles, so the grants belong in varbase_content_base.

This recipe now owns the module installs and nothing else:

name: Varbase Canvas Base
type: Varbase Canvas
install:
  - canvas
  - canvas_override

The whole config: block is gone. README.md and CHANGELOG.md are rewritten to match, and the composer.json description no longer claims the recipe grants permissions. The requirements are unchanged: drupal/core: ~11.4.0, drupal/canvas: ~1, drupal/canvas_override: 1.0.x-dev.

What still moves

Only canvas_override. varbase_content_base drops its canvas_override install and its drupal/canvas_override requirement, and keeps every permission grant untouched. That change is written but not yet submitted — it needs its own issue and MR.

Unchanged and deliberate, as recorded on the issue: the canvas install stays in varbase_media_base; canvas_icon_picker belongs to varbase_admin_base (see #3620064, #3620066); canvas_translate stays in varbase_i18n_base; the canvas_html_* text format permissions stay in varbase_editor_base.

Testing

Fresh drush site:install varbase on a clean Varbase 11 DDEV build, with this recipe plus the pending varbase_content_base and varbase_starter changes overlaid. Verified after install:

• canvas and canvas_override enabled.
• content_editor, content_admin and site_admin carry exactly the same Canvas permissions as a stock build - byte-for-byte the same list as before !1 (merged) - now granted by varbase_content_base rather than by this recipe.

Not done: no browser testing of the Canvas editor itself, and no upgrade-path testing on an existing site.

AI-Generated: Yes

Checkpoints

• File an issue
• Addition / Change / Update / Fix
• Automated unit testing coverage
• Automated functional testing coverage
• Testing to ensure no regression
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by a human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release