correct install description

Given that the composer.lock file is part of the repo, composer install is enough.