task: #3620193 Add Varbase Canvas Base recipe

#3620193

What this does

• recipe.yml — add varbase_canvas_base to recipes:, immediately after varbase_users_base.
• composer.json — add "drupal/varbase_canvas_base": "~1.0.0".

That is the whole diff, plus a CHANGELOG entry.

Why it goes early in the list

Right after varbase_users_base, not at the end. Varbase Admin Base, Media Base and Content Base all sit later in recipes: and expect Drupal Canvas to be present, and the roles that Canvas permissions attach to are created by varbase_users_base.

Scope

Varbase Starter is the only recipe that applies Varbase Canvas Base. The Vardot site templates — Educare, Horizon Aid, RightUp — deliberately do not require it. They apply Varbase Content Base and Varbase Media Base directly, the canvas module install stays in Varbase Media Base, and the Drupal Canvas permission grants stay in Varbase Content Base, so all three are unaffected by this change.

canvas_icon_picker is untouched here — it belongs to Varbase Admin Base, per #3620064 and #3620066.

Ordering — read before merging

Merge this before, or together with, #3620192 (Varbase Content Base dropping the canvas_override install). Merging that one first leaves a window in which a fresh Varbase Starter build installs no canvas_override at all.

Testing

Fresh drush site:install varbase on a clean Varbase 11 DDEV build, with this change and the #3620192 change overlaid. After install:

• canvas and canvas_override both enabled — canvas_override now via varbase_canvas_base.
• content_editor, content_admin and site_admin carry exactly the same Canvas permission list as a stock build.

drupal/varbase_canvas_base:1.0.x-dev confirmed resolvable by Composer at the merged 8c36612, and the drupal.org release is packaged and downloadable.

Not done: no browser testing of the Canvas editor itself, and no upgrade-path test on an existing site.

AI-Generated: Yes

Checkpoints

• File an issue
• Addition / Change / Update / Fix
• Automated unit testing coverage
• Automated functional testing coverage
• Testing to ensure no regression
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by a human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release