Poetry production installs: per-command `--no-dev` flag or project-level group restriction?

I'm packaging a Python application for production deployment and want to guarantee that development and test dependencies never end up in the production environment. Poetry documents two ways to achieve this: passing --no-dev (or --only main) to poetry install on each invocation, or restricting installation to the main dependency group at the project configuration level so plain poetry install excludes dev packages by default.

The constraint is consistency across a team and CI pipeline. The flag approach is flexible but depends on every install command remembering it, while the configuration approach enforces the policy centrally but is less obvious to someone reading a deployment script. I'm also unsure how the two interact if both are used, and whether regenerating the lock file after adding new dev dependencies affects either approach differently across Poetry releases.

For a project where production installs must never accidentally include dev dependencies, which approach is the safer default?

Are there documented cases where combining group restrictions with --no-dev changes resolution behavior, and does either method survive poetry lock regeneration without extra steps?