fix(docker): USER root before global npm install in derived images

[tbrandenburg]

Issues fixed

Fixes #15

Summary

derivedDockerfile() in src/docker-image.js builds a derived sandbox image as FROM <image> + RUN npm install -g @tbrandenburg/node-red-cli@<version>, with no USER root step. Base images with a non-root default USER (e.g. node:*-slim images that set USER node) fail with EACCES on /usr/local/lib/node_modules.

This adds USER root immediately before the npm install step. Derived images now always run as root; restoring the base image's original default user was intentionally left out of scope (would require inspecting the base image at build time) and is documented via a code comment.

defaultDockerfile() (the node:24-slim-based default sandbox) is untouched — it is already root by default and not part of this issue.

Validation commands run

• make ci (format + lint + test + audit) from the fix branch: 116/116 tests pass, lint clean, 0 npm audit vulnerabilities.

E2E coverage

No new E2E test added. This is a Dockerfile-string-generation fix; the existing unit test (test/unit/docker-image.unit.test.js) now asserts USER root appears immediately before the npm install -g line in the generated derived Dockerfile. A true E2E repro would require pulling a real non-root community base image (e.g. ghcr.io/tbrandenburg/agentic-workflow-dev-env:0.1.5) and running docker build, which the existing test suite does not do for any --docker path; out of scope for this minimal fix.

Risks / follow-ups

• Low risk: USER root is a no-op for already-root base images; only changes behavior for non-root base images, fixing the reported failure.
• Follow-up (not implemented, out of scope per issue): clearer error message when the target image's Node.js version doesn't satisfy engines.node (currently only an easy-to-miss EBADENGINE npm warning). No new issue filed since the original issue already documents this as lower-priority/optional.