The old hash worked for me locally but not on another machine when
pulled from GH (reproduced locally too with --rebuild). The issue
was that having *specific* detached git state makes composer produce
different metadata in vendor/composer/installed.php (and other files).
Being detached *from a branch* does not seem to have an effect, but
being detached *from a commit* does. Therefore, the vendor/ metadata
was highly affected by local git/jujutsu state.
