What Problem This Solves

Fixes an issue where CI and contributors building the non-root installer smoke image could wait indefinitely when the NodeSource setup script endpoint stalled. The existing pipeline could also execute a partial response before the download completed.

Why This Change Was Made

Download the NodeSource setup script to a unique temporary file with a 10-second connection timeout and a 120-second transfer limit, then execute it only after curl succeeds. This bounds only the setup-script fetch; the subsequent NodeSource setup and apt operations are unchanged.

User Impact

Non-root installer smoke image builds now fail within a bounded time when the NodeSource script download stalls, and they no longer execute a partially downloaded setup script.

Evidence

• node scripts/run-vitest.mjs test/scripts/test-install-sh-docker.test.ts on Node 24.15.0: 73 tests passed.
• oxfmt --check test/scripts/test-install-sh-docker.test.ts: passed.
• git diff --check: passed.
• Controlled stalled-response proof:
  • Before: curl timed out, but the pipeline returned status 0 and both the partial script and the following command ran.
  • After: the command returned curl status 28; neither the script nor the following command ran.
  • Successful response: the script ran and the temporary download was removed.