Use release sha if provided when installing .sh slugs

cc: @liamneesonsarm @gerbercj @jjrussell