Drupal - How can I ensure automatically that a module is disabled on my live site?

You can hide modules from the admin UI by using the hidden property in the module's .info file:

hidden = TRUE

This method might be useful if you want to make sure the module is never enabled via the UI.

In case you're interested in how to do the opposite (stop a module from being disabled), it's also done in the .info file by setting the required parameter:

required = TRUE

Once you've done that Drupal will see the module as a 'core' module and stop it from being disabled through the admin UI.

In the standard Drupal deployment methodology, only code is move from dev -> stage -> prod, and only the database moves from prod -> stage -> dev. Since modules' enabled state is stored in the database, if you follow this workflow, you do not need to worry about your dev modules becoming enabled in production.

Your problem then becomes the inverse: how to insure that your dev modules are automatically enabled for you when you move your database to dev. If you use Drush sql-sync to move your database, then the example file sync_enable.drush.inc shows how to enable dev modules as a post-sql sync task. You can also automatically disable production-only modules such as securepages if you wish.

There is a module that does almost exactly what you ask: Environment Modules. The only difference is that is does not disable modules based on the environment (dev/staging/production), but it enables them. That means that your normal site configuration should contain only the modules you need on the live site, and you configure Environment Modules to enable additional development modules only on the dev server.

If you decide to try/use this module, I'd like to hear how it works for you.