Fixed.
So this is a weird one. Composer broke because the composer.json that was loaded in Plesk was deleted (which is why the app folder was set to something in .trash). My guess is git moved the old versions to the trash when it updated them, breaking Composer.
I had to manually run a command as root to re-register httpdocs as the app folder for your composer, then switch it back for you in the UI. The old broken folders are still going to show as options as there is actually no way to remove them from the system short of manually editing composer's database. It now shows 2 up to date dependencies and 1 not installed.
If this is being caused by git deleting the composer.json, the unorthodox solution of committing the vendor folder to the git may very well be the best solution...