prime-agent kit: agent-readable CA-bundle (port from paseo) — load-bearing #371

Part of epic #368. Add the CA-bundle block (PROXY_CA_CERT_B64 + /etc/ssl/certs/ca-certificates.crt → $HOME/.local/state/prime-agent/ca-bundle.pem, export NODE_EXTRA_CA_CERTS) to BOTH the install script (forwarded across any sudo hand-off, per openchamber's sudo env idiom) and the kernel bootstrap. Source: paseo-start.sh CA block (GSA-TTS's own first-party code). Fixes the SELF_SIGNED_CERT_IN_CHAIN failure verified live on non-uid-1000 images (FAIL→200). Without this the kit cannot reach USAi. Deps: #370 (edits install), # (edits bootstrap — coordinate). Live-test: yes (in-guest node fetch api.gsa.usai.gov → 200).