Avoid piping remote Bun installer directly into CI shell

## Problem

The GitLab CI setup currently pipes the remote Bun installer directly into a shell. A downstream patch adjusts `.gitlab-ci.yml` to avoid the direct `curl | bash` pattern.

## Expected behavior

CI should avoid piping remote installer output directly into the shell where a small safer alternative is available, such as downloading to a file, optionally inspecting/checking it, and then executing it.

## Current downstream patch

A downstream patch changes `.gitlab-ci.yml` from a direct pipe to a safer multi-step installer flow.