cordova-fetch npm install --production clobbers node_modules, causes workflow issues

I have tried and failed to provide a reproduction of this issue and have hence written/deleted/rewritten this issue many times without submitting, but now I'm going to just submit it, hope for feedback, and continue to try and reproduce:

Basically, since this issue (https://issues.apache.org/jira/browse/CB-13303), cordova-fetch uses the `--production` flag with `npm install`, which tells npm not to install any "devDependencies".

This seems like a sound approach, but for reasons that I can't reliably reproduced/put my finger on, it seems like this flag is also aggressively removing packages from `node_modules`, causing the following workflow issues:

In my cordova project, I've added `cordova` as a dependency to package.json and encourage my teammates to use `./node_modules/.bin/cordova` rather than some globally installed `cordova` executable so that all dependencies are locked down and we don't have to fight the dependency hell of global CLI dependencies + local package.json dependencies.

Now, when I freshly clone a repo, do an npm install, and then run `./node_modules/.bin/cordova prepare`, it will non-deterministically fail with the following output:

Discovered platform "ios@^4.5.3" in config.xml or package.json. Adding it to the project
Using cordova-fetch for cordova-ios@^4.5.3
Error: Failed to fetch platform cordova-ios@^4.5.3
Probably this is either a connection problem, or platform spec is incorrect.
Check your connection and platform name/version/URL.
Failed to get absolute path to installed module
Error: No platforms added to this project. Please use `cordova platform add <platform>`.

And when I look at node_modules, most of my dependencies have been deleted, and in particular, there's no more `node_modules/.bin/cordova` executable.

My best guess is that the `npm install --production --no-save` that cordova-fetch internally does is nuking a bunch of dependencies considering "non-production", including the cli folder itself. The remedy is to use a globally installed cordova CLI executable, which somehow avoids these issues.

Both my local and global cordova executables are 7.7.4.

I will continue to try and provide a consistent reproduction of this issue; I've tried and failed many times and I'm starting to pull my hair out. I just wanted to officially post this issue in case other people have seen it, have advice, or have had better luck reproducing.