Avoid dev packages when building the phar

I'm not sure what "version" was being referred to when choosing `installed.json` over `composer.lock`, but the former has no notion of dev/no-dev whereas the later does.  This works for me, but is a breaking change in that the current default includes dev packages.  Alternatively there could be --dev / --no-dev options to `build` defaulting to `--dev`, but allowing `--no-dev` similar to `composer` itself.