ci(code-quality): fix all jobs — remove cache, unify install flags

Root cause: without composer.lock, hashFiles('**/composer.lock') returns
an empty string, so all jobs shared the same cache key 'Linux-composer-'.
The security job installed with --no-dev and cached first; subsequent jobs
restored that cache and ended up with a vendor/ missing dev packages.

Fix:
- Remove all Composer cache blocks (no lock file = no stable cache key;
  cold install on ubuntu-latest takes ~15s, not worth the risk)
- Remove --no-dev from security job (composer audit works on installed
  packages — no need for a separate --no-dev install)
- Add --no-scripts to all composer install steps
- php bin/kcode in all kcode steps (vendor/bin/kcode is not created when
  running inside the devkit repo itself)

Author: walmir-silva

.github/workflows/code-quality.yml

@@ -32,17 +32,6 @@ jobs:
       - name: Validate composer.json
         run: composer validate --strict --no-check-lock
 
-      - name: Get Composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          restore-keys: ${{ runner.os }}-composer-
-
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-scripts
 
@@ -65,19 +54,8 @@ jobs:
           tools: composer:v2
           coverage: none
 
-      - name: Get Composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install dependencies (no-dev for audit)
-        run: composer install --no-dev --prefer-dist --no-progress
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress --no-scripts
 
       - name: Run composer audit
         run: composer audit --format=plain
@@ -98,19 +76,8 @@ jobs:
           coverage: none
           tools: composer:v2
 
-      - name: Get Composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
       - name: Install dependencies
-        run: composer install --prefer-dist --no-progress
+        run: composer install --prefer-dist --no-progress --no-scripts
 
       - name: Initialize devkit config
         run: php bin/kcode init
@@ -134,19 +101,8 @@ jobs:
           coverage: none
           tools: composer:v2
 
-      - name: Get Composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
       - name: Install dependencies
-        run: composer install --prefer-dist --no-progress
+        run: composer install --prefer-dist --no-progress --no-scripts
 
       - name: Initialize devkit config
         run: php bin/kcode init