I can’t speak to use of composer for this (wouldn’t you need to create your own composer package…?) but here is what I do.
I use version control for my local dev and deployments. I have some code in my entry script that detects the environment (there are extensions for this) and loads the correct config based on environment. For example, different DB connections, different logging / debugging, etc.
I keep the whole project source tree including framework and vendors in source control. So for me, deploying is a matter of creating a working tree on the server. I don’t mess with migrations, its on my list to look at.
By default, the debug module only works when browsing the website from localhost. If you want to use it on a remote (staging) server, add the parameter allowedIPs to the configuration to whitelist your IP: