prime-agent kit: unprivileged install + integrity gates #370

Part of epic #368. Author prime-agent-install.sh: fetch the vendor installer to a file, gate on a repo-pinned installer SHA-256, pin the exact release, run it, then re-verify the installed dist/bundle/cli.js against a repo-pinned bundle SHA-256 (uninstall + fail-closed on mismatch). Install unprivileged (openchamber drop-sudo pattern: per-user npm_config_prefix=$HOME/.npm-global, no root-owned files in agent home). Re-derive all pins from the vendor live — do not copy any mirror values. Deps: #369. Live-test: yes (install lands, marker written, negative-pin uninstalls, no root-owned agent-home files).