Well I'm not running on the target machine - in that example I ran "file" on a different Linux distro, but reading "vmlinuz64" from a (USB-connected) drive where TC15 is installed for booting on a different PC.
My thinking is that if someone runs your script, they're going to be wanting the resulting extensions inside a tce/optional directory, usually on the same drive as the TC installation's vmlinuz file. Therefore if they can write to tce/optional from the system running the script, they can probably read the vmlinuz file that will boot that TC installation.
Really it's no easier to find vmlinuz on the target machine or off it, because it's only read by the bootloader. On that TC15 installation of mine the EFI partition where vmlinuz lives isn't even mounted normally while TC is running since it's not used after the bootloader has run. But the script could still try looking in likely places such as "../../vmlinuz" or "../../boot/vmlinuz" for it, which might work for common TC installations.