Fix staging composer dev dependency group

[btli]

Related issue

N/A — remedial Test / CI fix.

Summary

Adapt the personal staging ring's composer test gate to upstream's migration of development dependencies from the dev extra to the dev dependency group. This replaces --extra dev with --group dev in both workflows and their local-test documentation.

Hourly run 31760769644 is the red evidence: the prior invocation failed because extra dev is no longer defined.

Test Plan

• uv run --frozen --group dev python -m pytest .github/scripts/personal-staging/
• Result: 61 passed in 268.08s (0:04:28)

Demo

N/A

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added / updated
• Integration tests added / updated
• E2E tests added / updated
• Manual verification completed
• Existing tests cover this change
• Not applicable

Coverage notes

No new tests are needed for this mechanical invocation fix. The existing 61-test staging-composer suite passes with the dependency group invocation; mutation-check is N/A. Hourly run 31760769644 provides the failing pre-fix evidence.

Changelog

N/A — CI-only invocation repair with no user-facing change.

[btli]

Merge ruling (auto-mode): Pytest (misc) failure ruled non-blocking — pre-existing upstream flake, unrelated to this diff.

• Failing test: tests/host/test_connect.py::test_launch_cancelled_midspawn_does_not_leak_untracked_runner (DID NOT RAISE CancelledError), 3/3 attempts of run 31761791381.
• Investigation (independent read-only agent): the test has a latent race since upstream 4d4ddb2 (2026-08-04) — _handle_launch has no await points after the shielded spawn, so if the test's waiter thread is descheduled ≥~20 ms, the launch task completes before task.cancel(); demonstrated deterministically via delay injection (0/5 ms pass, 20 ms reproduces the exact CI symptom).
• This PR touches only .github/scripts/personal-staging/ + two personal-staging*.yml workflows — disjoint from the CI workflow; merge-ref Python is byte-identical to base 364c5e9 / upstream 849af06. Upstream Pytest (misc) green at the parent commit 244ded1 (identical tree for this module); no upstream fix exists yet.
• Reruns of one workflow run share the same xdist distribution → correlated outcomes; local repro at base: 0/40 failures across xdist/solo/loaded runs.
• Suggested upstream fix (follow-up): hold the mocked spawn open with a second event released after task.cancel(), pinning the cancel inside the leak window.
• Tribunal: dual-CLEAN (codex + claude_code) at c64c7a0; all other substantive CI green.