I believe I have found a solution (fix) to "composer not opening from within Power Virtual Agent"
Firstly I should confirm that I'm installing it for "all users" (C:\Program Files\...) with the System account (via SCCM).
But for trouble-shooting purposes I tried a per-user install, temporarily giving my account local admin privileges, else I would have trouble with AppLocker stopping it.
With the per-user install I tried the PVA website again and this time I was presented with an additional prompt to "always allow web.powerva.microsoft.com to open this type in the associated app" and to click Open. This had not appeared when I installed the all-users version, so it makes sense it couldn't be directed to the Composer app.

I did some searching and found that with the per-user installation, the association/link had been created in the registry HKEY_CLASSES_ROOT\bfcomposer and pointed to the application EXE file path within my Profile appdata area.
So I decided to export HKEY_CLASSES_ROOT\bfcomposer then simply edit the values to the path to "C:\Program Files\Bot Framework Composer\Bot Framework Composer.exe" "%1"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\bfcomposer]
@="URL:Bot Framework Composer"
"URL Protocol"=""
[HKEY_CLASSES_ROOT\bfcomposer\DefaultIcon]
@="C:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe,1"
[HKEY_CLASSES_ROOT\bfcomposer\shell]
@=""
[HKEY_CLASSES_ROOT\bfcomposer\shell\open]
@=""
[HKEY_CLASSES_ROOT\bfcomposer\shell\open\command]
@="\"C:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe\" \"%1\""
I completed a new "all users" installation then imported the registry values that were missing. I went to the website, tried the Open with Bot Framework Composer. I was prompted to "Always allow....", ticked the box, clicked Open and it worked! The project opened with the local Bot Framework Composer app (after some authentication prompts). Interestingly, it continues to show the window "We tried opening...on your computer" box but you can close/ignore it. Perhaps this always shows to give you the option to copy the link should you need it??
My "fix" for our app-deployment is to install the app (for all-users) and then post-installation add those registry values to complete the association. This is straight forward enough as we use PSADT.