title: Calls to `composer install` should only ever use satis dist zip files, never source
body: <p>We're using a satis repo to host zip file dependencies. Our composer.json file's repository array points to the satis repo and disables packagist. But when we run composer update, composer.lock still lists the original source under "source" (The one listed in satis.json under repositories). The satis is listed under "dist". Which is a problem because a call to composer install will download the source. </p>
  
  <p>How can I have calls to composer install only download the satis dist zip file and nothing else?</p>