Honor disablePackageReplace() in RootRemoveComposerJsonDecorator

[kayw-geek]

Summary

• disablePackageReplace() was incomplete: ReplaceSectionJsonDecorator skipped writing the replace block, but RootRemoveComposerJsonDecorator still stripped merged packages from root require / require-dev.
• Net effect: merged packages ended up neither in replace nor in require, so Composer never installed them, vendor/<vendor>/ was missing, and autoload failed (e.g. trait-not-found at runtime).
• These two decorators are a pair (replace declares self.version, remove drops the now-redundant entry). Disabling one without the other is incoherent — fix is the same one-line guard.

Test plan

• New RootRemoveComposerJsonDecoratorTest covers default-removal and disabled-keeps-root cases.
• vendor/bin/phpunit (69 tests, all green).
• composer check-cs, composer phpstan, composer fix-rector all clean.