In order to extract the file from the repository, you must have access to the repository. It's really that simple: you must have (at least enough of) the entire ball of hair so that you can get all the parts that make up one file. (In particular, you need the object file, if there is one, or the pack-file that contains the object, likely delta-compressed against other parts of the pack-file.) You do not need a work tree, but you do need a clone (though possibly a "shallow" one, depending on whether and how much you want to reach back in history, and possibly remote).
You can hide this by putting the repo somewhere behind the scenes, or even on another machine and using some secret interface to quietly extract the file from that other machine and bring it over—that's what gitweb does, in fact: the clone is on the web server and the "secret" interface is plain old http—but you must have access to the repo. In the answer Drax linked in a comment, the "secret interface" is any useable git transport (git:, ssh:, etc)—i.e., the same thing you would use to make a clone of the repository. The git archive command gives you shell-script-able read-only access to the remote repository, although its output format is a tar or zip archive (so you must extract the file(s) you want).
The oddball part of your question is this bit:
How can I get just this script, without having to clone/checkout/etc? I.e. I don't want to require a working copy just to get this one file.
and that's due to the phrase "working copy". Git uses "work tree" as a technical term, describing its three-part setup: the repository (or clone) itself, the "index" or "staging area", and the "work tree". It's not clear whether you mean "work tree" when you say "working copy".
Again, you need (access to) the repository: a clone, or access to one. You do not need a work tree. To extract a file whose path is filepath from a repository in repopath, from the revision named by rev, use git --git-dir=repopath show rev:filepath to extract the file to standard output. Any revision specifier from gitrevisions is suitable, so you may use a branch or tag name, or HEAD, or a raw commit ID: git --git-dir=/some/path/to/repo.git show deploy:path/to/file.txt for instance. (The repopath is relative to the repository, and may refer to a bare clone.)
To use any git transport to access a remote repository and extract a single file, use the git archive command as shown in that other answer, e.g., instead of git show deploy:path/to/file.txt, you might use git archive --remote=url deploy:path/to file.txt | tar xf - (which will extract one file into ./file.txt), or git archive --remote=url deploy: path/to/file.txt | tar xf - (which will extract the same file but into ./path/to/file.txt).
