Keep vendor and node_modules out of a path repository's copy

Composer mirrors a path repository with "symlink": false through the
source's .gitattributes export-ignore rules and nothing else, so an
application wired to this working tree (SealShare, plan step 43) would
copy the package's own 267 MB of vendor/ and node_modules/ into its
vendor/. Neither is ever in a git archive, so tagged installs are
unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -2,18 +2,21 @@
 
 *.woff2 binary
 
-# Development only: kept out of the archives Composer installs.
+# Development only: kept out of the archives Composer installs, and out of the copy a path
+# repository with "symlink": false makes (Composer mirrors it through these rules).
 /.editorconfig export-ignore
 /.gitattributes export-ignore
 /.github export-ignore
 /.gitignore export-ignore
 /bin export-ignore
 /docs export-ignore
+/node_modules export-ignore
 /package-lock.json export-ignore
 /package.json export-ignore
 /phpunit.xml export-ignore
 /pint.json export-ignore
 /testbench.yaml export-ignore
 /tests export-ignore
+/vendor export-ignore
 /vite.config.js export-ignore
 /workbench export-ignore