Epic: prime-agent on the msb backend (recipe, ADR, tests) + the mawk kit-drop blocker #467

Goal

Make prime-agent a natively supported agent on the msb backend (acq run prime-agent .), and fix a general blocker that silently drops every kit's files on the most common host OS. Built fresh on GSA-TTS; a private mirror was inspiration only.

Issues

• BLOCKER (do first, standalone): mawk interval-regex drops all kit files on Debian/Ubuntu
• msb prime-agent backend recipe (install machinery + KNOWN_AGENTS + case statements)
• ADR for prime-agent-on-msb (hybrid placement, digest-gated vendor installer, the two known limitations)
• Agent-list dedup / single-source (KNOWN_AGENTS duplicated across msb.sh + sbx.sh; four case statements must agree; three docs hand-maintained)

Cross-repo dependencies

• The prime-agent kit + USAi catalog live in GSA-TTS/agentic-coding-patterns (see its two epics). The msb recipe installs the binary; the kit supplies models.json. prime-agent is deliberately ABSENT from sbx's KNOWN_AGENTS (sbx boots a per-agent template image and no prime-agent template exists — listing it would advertise a launch sbx can't perform; a test must pin that divergence).
• The mawk fix is a general blocker (affects ALL kits, not prime-agent) and MUST land first, ahead of any kit work in either repo.

Verified (live, msb 0.6.12)

msb wire-substitution works for prime-agent (USAi 200); the Node CA trap (#SELF_SIGNED on non-uid-1000 images) is fixed in the patterns kit via the paseo CA-bundle pattern.

AI-assisted (OpenCode).