Great question..
First... some of your rankings problem may be around this - "Guest Posts, Citations, Media mentions, Profile links etc."... at least 2 of those items carries some decent risk, the consequences of which would be "not ranking". Have you checked search console to see if any manual actions exist? Did you have rankings and they disappeared, or have you been unable to secure rankings in general? Does the site currently get organic traffic, but just maybe on terms that you aren't targeting?
As far as the development site, this could easily be a separate issue from your rankings, and I would doubt this would cause significant rankings drops if the dev site isn't being indexed by Google. Would you be lucky enough to have any type of access to this through a CMS login? If so, you could easily verify the site in search console and see where things stand in terms of indexing. Additionally, if you could access through the CMS, you might be able to change a few settings, such as canonical tags, "website" or discourage indexing (if wordpress), etc. .that would cause the site to begin redirecting to your clientwebsite.com or at least give the indication that it is a known copy.. Did you check the individual pages of the site to see if a meta tag is in place on the pages blocking robots?
Ultimately the easiest thing regarding the dev site would be to simply ask the dev company to remove the site...
Cheers,
Jake