Refactor repository path logic and add locally tracked method

src/Installer.php

@@ -281,20 +281,26 @@ protected function mergeStash(string $stash, string $base, string $install): voi
      * Returns true when the package is served by a local path repository.
      * Path repos have source == install path, so the normal download/delete cycle would
      * wipe the user's files before trying to copy from the now-missing source.
-     *
-     * With symlink:true, a genuine path repo creates a real OS symlink. A module installed
-     * from Packagist into the same directory is a real directory — not a true path repo.
      */
     protected function isPathRepository(PackageInterface $package): bool
     {
         if ($package->getDistType() !== 'path') {
             return false;
         }
 
-        $path = $this->getInstallPath($package);
+        return $this->isLocallyTracked($this->getInstallPath($package));
+    }
 
-        // Genuine path repos: OS symlink (symlink:true) OR a git-tracked dev clone (.git present).
-        // Packagist-installed modules have .git removed by DEFAULT_EXCLUDED_DIRS — they are neither.
+    /**
+     * Returns true when the install path is a locally-managed directory that should never
+     * be overwritten by the installer — either an OS symlink (path repo with symlink:true)
+     * or a git-tracked dev clone (.git present).
+     *
+     * Packagist-installed modules have .git removed by DEFAULT_EXCLUDED_DIRS, so they never
+     * match this check and remain updateable from Packagist.
+     */
+    protected function isLocallyTracked(string $path): bool
+    {
         return is_link($path) || is_dir($path.'/.git');
     }