PG002: Avoid piping remote scripts to shell

Piping curl or wget output directly to a shell (sh, bash, zsh) executes remote code without any verification. If the remote server is compromised or someone performs a man-in-the-middle attack, arbitrary code runs in your build with full root privileges. This is a real supply-chain attack vector. Download the script first, verify its checksum, then execute it.