Hermes install: join the download and run with && so a failed fetch cannot run a stale installer

[richardli-design]

Summary

The Hermes install instructions download the install script and run it as two separate
commands. curl -fsSL ... -o <file> leaves an existing file byte-identical when the
transfer fails, so a failed re-download can be followed by a successful run of a
previously downloaded installer. Joining the two with && fixes it.

Current (README lines 33-38):

curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install.sh -o /tmp/shopify-hermes-install.sh
bash /tmp/shopify-hermes-install.sh

Why this can bite

/tmp/shopify-hermes-install.sh is a fixed path, so a second run of these instructions
reuses the first run's file. If the download fails for any reason (network blip, the raw
URL 404ing after a rename or branch change, a proxy returning an error body), step 2 still
finds a readable script at that path and executes it. The user sees a curl error scroll
past, then an installer that appears to run fine, and silently reinstalls an old version.

Reproduced with curl 8.7.1:

$ printf 'echo STALE-INSTALLER-RAN\n' > repro.sh
$ wc -c < repro.sh
      25
$ curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install-nope.sh -o repro.sh
curl: (56) The requested URL returned error: 404
$ wc -c < repro.sh
      25
$ bash repro.sh
STALE-INSTALLER-RAN

The output file is untouched by the failed fetch, and the stale script runs.

Proposed fix

curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install.sh -o /tmp/shopify-hermes-install.sh && bash /tmp/shopify-hermes-install.sh

Once execution is guarded, a leftover file is inert, so this is sufficient on its own.
mktemp plus a trap cleanup is tidier but buys hygiene rather than safety, and it
roughly doubles the length of a command people read off a docs page and paste. curl ... | bash is shorter still, but is worth avoiding for an install script.

--remove-on-error (curl 7.83+) is the purpose-built flag for the underlying behaviour and
could be added too, but && alone is enough and raises no version floor.

Where this appears

The same two lines are on three surfaces, which is why it seems worth fixing here rather
than on any one consumer:

1. This README, lines 33-38
2. https://shopify.dev/docs/apps/build/ai-toolkit#install-with-a-plugin-recommended, Hermes tab
3. https://www.shopify.com/build-with-ai, "Dev tools" section, Hermes tab (taken verbatim
   from the above, and happy to mirror whatever lands here)

Hermes is the only one of the eight tools whose install is two commands, so it is the only
one with this shape.

Minor, while you are in here: repo casing

The curl URL uses the canonical Shopify/Shopify-AI-Toolkit, while the Antigravity and VS
Code instructions use Shopify/shopify-ai-toolkit. GitHub resolves owner and repo
case-insensitively so nothing is broken, but normalizing on the canonical
Shopify-AI-Toolkit would stop the two forms reading like two different repos.