We have to sort out packaging (how does libraries/vendor get handled in new installs, updates, etc.) and making sure contributors can still contribute without being required to run the Composer CLI tool.

Hmm, as my personal opinion, the patch diff will not a big problem. And running composer is also not a problem since more and more opensource uses it, developers who want to contribute should read the manual to create dev environment for every project. (Like many packages on NPM)

But I think the BIG problem will be fix all tests and build scripts to make them run composer too after I take a quick look.

I just attempt to try this idea works or not. Seems it's work after I build a full install package. I'll leave the maintainer team to decide whether to do this or not in the future.

Simply deleting libraries/vendor from the repo and adding a composer install --no-dev step to the build script works. But there is a lot more to take into consideration then that. Right now the repo is in a fully usable state, anyone can git clone and run with it. The day we stop keeping the repo in a usable state, it starts making contributing for anyone who isn't a PHP developer more complex. Then if we started doing the same for compiled media assets (so only had raw ES6 scripts or SCSS in repo, no compiled CSS and JS) it would get more complex.

Definitely not best practice here, but this is one of those balancing acts we have to play as a project.

Yes so I think the main concern will not only about the build script but also includes the dev process for everyone.

BTW, I think this case is a little different from the SCSS/LESS compile things, more similar to the npm install thing. A repo can try to write some script to easily help developer quick prepare dev environment.

On the other hand. Currently if we want to modify CSS from jux or protostar files in 3.x branch, we still need to compile LESS files. So if I can run grunt --watch to help me quickly compile all assets files, I will feel it more easier to contribute the frontend code if I'm not an experienced developer. (Maybe everyone has different felling).

Just personal opinion, we can listen that how other contributors think.