fix(e2e): download non-root installer before execution

Download the non-root Docker smoke installer before executing it.

- preserve the existing 30-second connection and 300-second transfer limits
- clean up the temporary installer on success or failure
- prove failed downloads cannot execute partial installer content

Co-authored-by: thomas.szbay <xydigit-zt@users.noreply.github.com>
Punchcard-Session: golden-lantern-meadow-0x

scripts/docker/install-sh-nonroot/run.sh

@@ -62,7 +62,12 @@ node -e '
 command -v npm >/dev/null
 
 echo "==> Run installer (non-root user)"
-curl -fsSL --connect-timeout 30 --max-time 300 -- "$INSTALL_URL" | bash
+# This non-root harness downloads first; public smoke and CLI lanes intentionally
+# retain their streaming installer contract.
+installer="$(mktemp)"
+trap 'rm -f "$installer"' EXIT
+curl -fsSL --connect-timeout 30 --max-time 300 -o "$installer" -- "$INSTALL_URL"
+bash "$installer"
 
 # Ensure PATH picks up user npm prefix
 export PATH="$HOME/.npm-global/bin:$PATH"