Hence my suggestion that the Debian project distribute a script that I can run to get the firmware myself & trivially build my own install CD, and that this be prominently advertised on debian.org.

The Debian project already ships that sort of script in the current non-free firmware CD, so clearly it's not a legal issue. What it doesn't ship is the ability to run that on another machine as part of preparing an ISO to install on a fresh machine that needs the proprietary firmware.