Check out wp-cli to /srv/www using composer instead of phar
Composer is already available at this point in provisioning

Now that we're using it for WP-CLI though, we may want to remove the flag that allows the disabling of the composer install.
Up permissions on files in srv/www to 774 so that wp-cli can execute

This is a blanket fix and should probably be thought of more as we go. It doesn't really cause a security issue because this is all happening inside a VM on your local machine, but it's still worth thinking about.

One option is to not explicitly set dmode and fmode when mapping the directories and then handling that part manually through creative uses of chmod.
Use bash_profile for environment vars rather than bash_aliases

Per @danielbachhuber's comment on bbc25f8 - environment variables make more sense in bash_profile.