prime-agent kit: skeleton + spec.yaml (hybrid/v1) #369

Part of epic #368. Create integrations/isolation/acq-kits/prime-agent/ with an independently-authored spec.yaml: schemaVersion: hybrid/v1, kind: mixin, deny-by-default caps.network.allow (prime-agent's own hosts: app.primeintellect.ai, the r2.dev bundle host, registry.npmjs.org, astral.sh/releases.astral.sh, pypi.org/files.pythonhosted.org, github.com/objects.githubusercontent.com — NO leading-* host, YAML-alias trap), files[] for the scripts + generated models.json, install/startup commands[] (numeric user), no publishedPorts (TUI, not a web UI), PRIME_AGENT_INSTALLER_PLAIN=1, agentContext. Must pass validate-kits.py --strict. Deps: none. Live-test: no.