docs(test): preserve the install.lock step in test/README

The pre-existing (untracked) test/README documented creating Dolibarr's
install.lock after a fresh install — a non-obvious operational step missing from
the rewritten README. Preserve it (generalized to the per-env namespace/label,
with a note that a prod-seeded instance doesn't need it).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/README.md

@@ -25,6 +25,22 @@ Copy `.env.example` to `.env` and fill it in. `.env`, `*.key`, and
 cp .env.example .env
 ```
 
+## Lock the installer (after a fresh install via `main.ts`)
+
+Dolibarr keeps its web installer reachable until an `install.lock` file exists.
+After a fresh install (the `main.ts` flow), create it in the target pod — for the
+sandbox:
+
+```sh
+kubectl -n erp-sandbox exec \
+  "$(kubectl get pod -n erp-sandbox -l app.kubernetes.io/instance=erp-sandbox -o name)" -- \
+  /bin/sh -c 'touch /var/www/html/install.lock && chown www-data:www-data /var/www/html/install.lock'
+```
+
+For prod, swap to `-n erp -l app.kubernetes.io/instance=erp`. Not needed when the
+instance was seeded from a prod dump instead of freshly installed — see
+`../ops/sandbox/`.
+
 ## Provision the sandbox
 
 Provisions `erp-sandbox.arcodange.lab`: enables the REST API module, creates the