feat: add curl installer for macOS and Linux

[kannandreams]

Tracking issue

curl -fsSL https://raw.githubusercontent.com/glyf-data/glyf/main/install.sh | sh
curl -fsSL https://raw.githubusercontent.com/glyf-data/glyf/main/install.sh | sh -s -- --update
curl -fsSL https://raw.githubusercontent.com/glyf-data/glyf/main/install.sh | sh -s -- --version 0.3.0

Approach

glyf is a Python package, not a static binary, so install.sh wraps uv instead of downloading and checksumming a tarball the way tuff/install.sh does. It detects the platform, installs uv if missing (official Astral installer), runs uv tool install glyf-core, then verifies by executing the installed glyf --version.

• POSIX sh, set -eu, shellcheck clean. No sudo anywhere — everything lands in uv's tool directory.
• --update upgrades, falling back to a plain install when nothing is installed yet. --version X pins (with --force, so it also works as a downgrade). --no-uv-install refuses to install uv for you. --help documents all of it.
• GLYF_INSTALL_DIR and UV_TOOL_BIN_DIR are honoured.
• When uv's bin directory is not on PATH, it prints the export PATH=... line and mentions uv tool update-shell, rather than editing rc files itself.
• Windows and unsupported architectures exit with a message naming the command that does work, instead of failing obscurely.

Hosting: raw.githubusercontent.com, not the docs domain

The issue proposed https://glyf.pages.dev/install.sh, but that domain sits behind Cloudflare Access during the beta, so an anonymous curl gets a login page rather than the script. The canonical URL is therefore the raw file on main. When the docs site opens to the public, add the docs-domain copy and switch the documented URL.

Verification

Exercised locally against a sandboxed UV_TOOL_DIR/UV_TOOL_BIN_DIR: fresh install from PyPI, re-run (idempotent), --update, --version 0.3.0, --version=0.3.0, GLYF_INSTALL_DIR, unknown-option rejection, missing-value rejection, and the --no-uv-install refusal path with uv stripped from PATH. Every one behaved as intended and glyf --version reported glyf 0.3.0.

New installer.yml keeps it honest: shellcheck plus a real install on ubuntu-latest, ubuntu-24.04-arm, and macos-15. The runners have no uv, so CI exercises the bootstrap path a first-time user actually hits, then re-runs for idempotence, upgrades, pins an exact version, and asserts an unknown option is rejected.

Docs

Install script section on the docs-site installation page (including how to read the script before running it), a short block in the README, and a line in llms.txt.