New: Headless --dev install driven by repos.json

[taylortom]

Fixes #97

New

• Headless --dev install now works. bin/install.js removes the "no effect in headless mode" warning and, after the umbrella clone, looks for a repos.json at the install root. If found, its entries drive installLocalModules; if absent, the install continues without local modules (preserves existing behaviour for non-forks).
• New lib/utils/loadDevModulesConfig.js — reads and parses the umbrella's repos.json, returns null when absent.

Update

• lib/utils/cloneRepo.js accepts an optional url that overrides the hardcoded adapt-security base. Backward compatible — all existing call sites (UI umbrella clone, CliCommand wrapper) continue to work unchanged since none of them pass url.
• lib/utils/installLocalModules.js now accepts options.modules as either strings (old behaviour, deferred to the hardcoded org) or { name, url } objects (new, used by the headless flow). Also correctly handles scoped package names (e.g. @cgkineo/foo) when deriving the local_adapt_modules/<dir> name.

Config shape

repos.json at the umbrella root is an array of { name, url }:

[
  { "name": "@cgkineo/adapt-authoring-collab", "url": "git@github.com:cgkineo/adapt-authoring-collab.git" },
  { "name": "adapt-authoring-core", "url": "git@github.com:adapt-security/adapt-authoring-core.git" }
]

Testing

• Fresh headless --dev install: npx adapt-security/at-utils install --dev --no-ui <fresh-dir> against an umbrella with a committed repos.json — verify all listed modules clone to local_adapt_modules/<short-name>/ with correct remotes, including multi-org entries
• Without repos.json: same command succeeds, prints skip message, leaves local_adapt_modules/ empty
• Existing UI install flow is unchanged (smoke test)
• Umbrella clone via UiServer.downloadHandler and CliCommand.cloneRepo still works (neither passes url, so fallback to hardcoded default remains)

Scope notes

This PR only covers install --dev. Headless update --dev is not addressed — bin/update.js still needs the same treatment in a follow-up. UI flow also still uses the adapt-authoring.json-based discovery path rather than repos.json; aligning those is a separate Phase 3 concern.