create composer.json, write lock file, ignore vendor/