Why is the signature fed through a bitcoin script? Not using a (non-turing-complete-but-still) programming language to encode a signature seems like a good first step to avoiding malleability.

Bitcoin has good/interesting reasons for using scripts inside transactions, but AIUI these are separate from the signature script.