Stop je_auto_control_dev shadowing the editable install in CI

The previous quality.yml step ran:
    pip install -r dev_requirements.txt
    pip install -e .

dev_requirements.txt's first line is `je_auto_control_dev` (a
separate PyPI package), which ships an OLDER snapshot of the
`je_auto_control/` tree directly into site-packages. Because that
snapshot predates the rounds 22-47 work it lacks `utils/admin`,
`utils/usb`, `utils/remote_desktop`, `utils/vision` and friends.

When `pip install -e .` follows, the editable .pth + finder land in
site-packages, but Python's import resolution still finds the
masking on-disk `je_auto_control/` first — so every
`import je_auto_control.utils.<new>` raises ModuleNotFoundError at
test-collection time.

Fix: pin quality.yml to install only what it actually needs:
the editable package + ruff/bandit/pytest/pytest-timeout/PySide6.
The legacy dev/stable workflows still use dev_requirements.txt for
their integration coverage; this change only narrows the quality
job's footprint.

Author: JE-Chen

.github/workflows/quality.yml

@@ -72,8 +72,16 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip wheel
-          pip install -r dev_requirements.txt
+          # Install the editable package FIRST so its source dir is the
+          # one Python sees on subsequent imports. We deliberately
+          # avoid `pip install -r dev_requirements.txt` here because
+          # that file pulls in `je_auto_control_dev` (a separate PyPI
+          # package), which ships its own snapshot of `je_auto_control/`
+          # straight into site-packages and masks the editable install
+          # for any sub-package the snapshot doesn't include
+          # (admin, usb, remote_desktop, vision, …).
           pip install -e .
+          pip install ruff==0.15.9 bandit==1.9.4 pytest==9.0.2 pytest-timeout==2.4.0 PySide6==6.11.0
 
       - name: Run headless pytest suite
         run: pytest test/unit_test/headless/ -v --tb=short --timeout=120