Which Composer configuration best skips dev dependencies during CI builds?

Goal

In continuous‑integration pipelines I want Composer to omit dev‑only packages automatically, so the vendor tree stays small and the install step is fast.

Constraints

The repository must stay usable for local developers who still need dev tools, and any CI tests that rely on dev packages must either be moved to the main dependency set or installed separately.

Questions

1. Does setting config.platform-dev to false permanently disable dev dependencies, or can it be scoped to CI runs only?
2. Which Composer script pattern best injects the --no-dev flag when a CI environment variable (e.g., CI=true) is present?
3. What are the risks of removing dev dependencies via --no-dev when CI jobs still need tools like PHPUnit or linting frameworks?