Installing without dev dependencies and then generating an optimised autoloader in two steps is the ordinary deploy sequence, and doing it in the wrong order produces a class map containing test classes that are no longer on disk.
$ composer install --no-dev --no-scripts --optimize-autoloader
$ composer dump-autoload --no-dev --classmap-authoritative
# authoritative means: not in the map, does not exist.
# no filesystem check, no PSR-4 fallback, one array lookup.--classmap-authoritative is the meaningful optimisation on a deploy that never generates classes at runtime, because it removes a stat call per class load. It is also the setting that breaks any library generating classes on the fly, which is rarer than it sounds but includes some proxy generators. Worth measuring rather than assuming: on a codebase of two thousand classes it was about six milliseconds a request, which is real but not transformative.