feat(scripts): curl-installer harvester to close the Linux-install gap

[noahhyden]

The gap

240 cli-tool recipes install nothing on a Homebrew-less Linux box — their only methods are brew/winget, so every guard fails and bootstrap dead-ends. That was the ollama bug (#65), registry-wide.

What this adds

scripts/curl_candidates.py — the maintainer helper that closes the mechanical subset, in the same propose → review → merge idiom as winget_candidates.py.

For each Linux-gapped, curl-less row whose id is in a vetted KNOWN_INSTALLERS allowlist, it proposes the official install script. Unlike winget there's no authoritative catalog, and a wrong installer runs the wrong software — so this is deliberately an allowlist, not a repo-probing guess. Every URL was confirmed to serve a real script (HTTP 200 + shebang). Each proposal is corroborated against the row's gh:

• high — URL served from the tool's own repo (raw.githubusercontent.com/<owner>/<repo>/...), or a domain matching the gh owner/repo (e.g. deno.land ~ denoland/deno).
• medium — a plausible official domain that doesn't corroborate; a human should eyeball it.

Only gapped rows lacking a curl key are proposed (idempotent against prior backfills); --apply stages keys into recipe_data.py for git review.

Generator

Adds a curl_shell field to gen_recipes.py so bash-only scripts render | bash instead of | sh (default stays sh) — needed because ~40% of official installers require bash.

Seeded allowlist (10, all HIGH, verified)

sh: deno, chezmoi, tailscale, pulumi, golangci-lint, trivy
bash: rclone, k3d, direnv, volta

$ python3 scripts/curl_candidates.py
resolved 10 curl installer(s) (high=10 medium=0) of 240 Linux-gapped row(s) -> curl_proposals.json

Not yet backfilled into recipe_data.py — left for your review (run --apply, then gen_recipes.py --rewrite). The remaining ~230 gapped tools need per-tool decisions (system package managers like apt/dnf, or GitHub-release binaries) that this curl harvester intentionally doesn't guess at.

Tests

tests/test_curl_candidates.py — 25 tests pinning the gap filter, the corroboration tiers (the security-relevant surface), idempotency, and apply_proposals staging. No network (allowlist is static). Full suite: 3645 passed, lint clean across 520 recipes.

🤖 Generated with Claude Code