deno install fails with permission error when USER deno is set before install step

The example Dockerfile in the README places `USER deno` **after** the `deno install` step, which means the install runs as root and has no permission issues. However, if a user reasonably moves `USER deno` earlier in the build. This is the more security-conscious approach but this causes the build to fail with:

```
error: Failed writing lockfile

Caused by:
Permission denied (os error 13) (for '/app/deno.lock')
```

This happens because `/app` is created by root and the `deno` user doesn't have write access to it.

Current README example order:

```dockerfile
WORKDIR /app
COPY . .
RUN deno install # runs as root, works fine
USER deno # switched after the fact
CMD [...]
```

Recommended fix — add a chown before switching users:

```dockerfile
RUN mkdir /app
COPY . /app/
RUN chown -R deno:deno /app # give deno user ownership first
WORKDIR /app
USER deno
COPY . .
RUN deno install # now works correctly
```

Suggested docs addition:
Add a note in the README that if `USER deno` is placed before `deno install`, the `/app` directory must be `chown'd` to the `deno` user first, otherwise the lockfile write will fail with a permission error.