Although still fairly dirty and hackish I have a working one step "installer" now. Keep in mind I have spent less then 2 hours, including research, moching it up.
It downloads and unpack composer, runs create-project flarum/flarum --stability=beta, move flarum from the generated flarum folder, to where the install script is located, and deletes composer and itself, after which it redirects you to the built inn flarum setup.
You can find current code here: https://github.com/andreherberth/pockethold
That said, current mockup requires allow_url_fopen... I will push cUrl support tonight.
Also, it is still lacking proper error code, and it contains a while loop which on error, will run for ever... Will also be fixed in tonights push.
I will also push a variant of the script tonight which installs bazar as well, enabling you to install extensions, effectively, at least until a new flarum version, do without shell.
My main goal is to keep this one file only.
Disclaimer: Should not be used in production. Also, please know it might be less likely you will receive any support regarding a forum installed in this manner. I will provide support for this script as long as I maintain it.