prime-agent kit: kernel bootstrap as agent user into $HOME/.prime #372

Part of epic #368. Author prime-agent-bootstrap-kernel.sh: run the vendor's gated kernel provision AS THE AGENT USER (startup phase), idempotent (skip when the venv exists), non-fatal. Ensures the ~350MB kernel venv lands in $HOME/.prime, not /root/.prime (a root provision hid it from the agent, which then silently re-bootstrapped mid-session). Deps: #369. Live-test: yes ($HOME/.prime/agent/kernel-venv exists for agent, /root/.prime absent, then a kernel tool call succeeds).