Composer should be managing all the app dependencies within vendor/
. Even if you already have a copy of ZF2 on the server, you should let composer do it's thing and install an app-specific copy. As well as keeping all the dependencies in one place this means you can easily have apps on the same server using different versions of ZF2, and easily upgrade/downgrade as you need to.
Composer can install packages not listed on packagist, either directly from source control or from zip/gzip files and so on. So let it take care of your private package as well.
You should be able to completely delete your vendor/
folder and then restore it again just by running composer install
. If you're not already in that position then I'd suggest you try and get there - it will make your life easier.
Answering your specific questions:
Do I have to edit the init_autoloader.php that is shipped with the ZendSkeletonApplication?
No.
What is the best practice to handle composer, git and autoloading in development and production?
The skeleton app uses the best practices:
vendor/
should be excluded from source controlcomposer.json
andcomposer.lock
should both be in source control
Should I use a large classmap for autoloading in production?
Classmaps always provide a performance boost over the standard autoloader. How much of a difference this makes depends on your app.
Composer is never used in production environment?
The composer autoloader is, yes. Personally I have composer install
as part of my automated deployment process to populate the vendor/
folder when I deploy a new version.