Nope, not possible to work without JSONP request. The only other option is a cross-domain POST to log you into Joomlapolis, which we've no plans of doing. We've considered a web API Key, but then it's too easy for people to share the keys with others to circumvent needing a valid subscription (the install from web cache is only active for 24 hours), which unfortunately would happen. Will review this further as we maybe able to implement web API Key usage by requiring the domain to be supplied in advance, which would help reduce sharing.
forge.joomlapolis.com/issues/7197
Note there is no guarantee this will be implemented. I don't forsee any issues implementing the functionality in package builder it self, but whether we use it or not will have to be discussed internally. We will have to discuss the risk assessment of doing this. We want install from web to be convenient, but we don't want 1 person sharing a key for example to 20 people; that wouldn't be good for our business model.