It would be great if we could set config in our pantheon.upstream.yml to force sites to use composer install over composer update. I think that the suggestion for minor updates is ok, but we’ve all been bitten by those minor Drupal updates before. I’d prefer that when I test my upstream, if it is 5mins later, 5 hours later, or 5 days later the upstream sites are using the same versions of modules and core as when I tested.
Thank you for sharing your feature request with us, Jack! We meet with our Product Team monthly to surface feedback and feature requests like this that come through our community, so I will make sure to share this with the team, and if I can provide an update, I will. Thanks again!