I think this is _wrong_.

 1. travis has PHP installed
 2. travis has composer installed
 3. a composer update does not install what's in the lock, but updates it (inconsistent results)