prime-agent kit: docs + ADRs (independently authored) #375

Part of epic #368. Write README.md + TROUBLESHOOTING.md (incl. a SELF_SIGNED_CERT_IN_CHAIN section) + ADRs: integrity gates, install-at-create, and a NEW ADR for the agent-readable CA-bundle + unprivileged-install decisions (cite paseo/openchamber precedent). File a source_inspiration intake record for upstream prime-agent (MIT) referenced from the kit PR. All prose original per §4.3. Deps: #370,#371,#372. Live-test: no.