refactor: skip autoload-dev dirs in class discovery

[gharlan]

ClassDiscovery::getRelevantPaths() treated every non-vendor PSR-4 prefix as project-level code. In a dev install that also pulls in the root package's autoload-dev directories — tests/, and dev tooling such as the custom rector rules under .tools/rector/.

Those classes never carry runtime attributes, so discovering them is pure overhead. Worse, getReflections() calls class_exists() on them, which autoloads dev-only vendor code: touching a Redaxo\Rector\* rule loads its Rector\AbstractRector parent, which triggers rector's scoped vendor autoloader. That scoped vendor ships its own installed.php, so once its loader is registered it shadows InstalledVersions::getRootPackage() (which then returns rector/rector-src with dev=false).

This reads the root composer.json and excludes its autoload-dev PSR-4 directories from discovery, so only runtime-relevant code (core, addons, the project's production autoload) is scanned. In a --no-dev install autoload-dev isn't registered anyway, so this simply aligns dev with prod.

Measured locally: relevant classes dropped 350 → 284, and a cold-cache console migrate no longer registers rector's loader.

[gharlan]

Closing: excluding the root package's autoload-dev dirs is the wrong discriminator — it also drops .tools/project (which carries #[AsTemplate] that discovery must find), not just the rector rules. There's no cheap signal separating dev tooling from the dev app.

The real problem this was meant to mitigate (rector's scoped vendor shadowing InstalledVersions::getRootPackage()) is already handled robustly at the consumer via a dedicated dev-flag lookup, so this discovery change isn't needed.