docs: recommend cargo install termlens-cli --locked

[cestercian]

What & why

The README and the skill's section 9b were the two places that recommended a bare cargo install termlens-cli. The CLI's own README, the daily install workflow and the report action all pass --locked, so the recommended path used the newest compatible dependencies instead of the set the release was tested with. Both lines now say cargo install termlens-cli --locked. Docs only.

Closes #541

Checklist

• Linked an issue (or explained above why none exists)
• Tests added/updated for the change: n/a, two prose edits
• cargo fmt --all and cargo clippy --workspace --all-targets --all-features are clean: no Rust changes
• All commits are signed off (git commit -s)
• No AI attribution trailers
• CHANGELOG.md updated under [Unreleased] (user-facing changes only): n/a, docs only
• Snapshot changes (if any) were reviewed with cargo insta review, not blind-accepted: n/a

.github/scripts/check-readme-links.sh passes on the edited files.

[vyncint]

Thanks! Both edits are the two places the issue named, and nothing else in the tree recommends a bare install: the remaining mentions describe the release check or sit in comments, and everything that runs it already passes --locked. The diff is exactly the two lines.

CI was red on this PR and on every other one when you opened it, for reasons unrelated to your change: an upstream action's v1 tag had moved, which tripped the zizmor audit, and a separate test race (now #555) tripped the features job once. The first is fixed on main (#554) and I updated your branch with it, so the re-run is all green. Merging.