## Summary

Replace all `curl | bash` / `curl | sudo bash` patterns with
download-to-tempfile-then-execute across the codebase.

Closes #574, #576, #577, #583.

| File | What changed |
|------|-------------|
| `install.sh` | Ollama installer (2 locations) |
| `scripts/install.sh` | NodeSource `setup_22.x` |
| `scripts/brev-setup.sh` | NodeSource `setup_22.x` |
| `bin/nemoclaw.js` | Remote uninstall fallback |

Each location now uses `mktemp -d`, downloads the script to a file,
executes from the file, and cleans up. SHA-256 pinning isn't practical
for rolling-release upstream URLs, but download-then-execute prevents
partial-download execution and allows inspection.

## Test plan

- [x] 4 regression tests verify no `curl | sh/bash/sudo` patterns in any
of the affected files
- [x] All existing tests pass
- [ ] Manual: `nemoclaw onboard` with Ollama provider installs correctly
- [ ] Manual: `nemoclaw uninstall` falls back to remote script correctly

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Replaced unsafe piped curl|sh install/uninstall flows with a safer
download‑then‑execute approach.
* Added explicit download failure handling and guaranteed temporary‑file
cleanup to reduce execution risk.

* **Tests**
* Added automated regression checks that scan install/uninstall scripts
to detect and prevent reintroduction of curl‑to‑shell patterns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->


Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

---------

Co-authored-by: Carlos Villela <cvillela@nvidia.com>