feat(v1): add trainable Prime Agent harness

[hallerite]

Summary

• add a thin Prime Agent harness on top of the shared ACP harness
• install a pinned Prime Agent release and route its OpenAI-compatible model calls through Verifiers interception
• support ACP MCP servers, skills, resume, and appended system prompts
• isolate per-trace Prime Agent state and daemon sockets while retaining reusable runtime caches

Why

Prime Agent's native model API uses streaming Chat Completions. The harness itself can stay small because the generic renderer-backed streaming bridge now lives in the parent PR, #2369. This PR contains only the Prime Agent integration.

With Prime Agent #1378, ACP-provided MCP tools are translated into session-scoped Python programs by Prime Agent itself. Verifiers supplies the environment's MCP URLs while Prime Agent owns its native tool representation.

Stack and dependency

• based on Support training with streaming harnesses #2369, which enables buffered training responses for streaming harnesses
• depends on Prime Agent #1378
• currently pins prospective Prime Agent version 0.7.3; align the pin with the release containing chore(deps): bump gitpython from 3.1.47 to 3.1.50 in /packages/verifiers-rl #1378 before merge

Validation

• focused Ruff and formatting checks passed
• uv run pytest tests/v1 -m 'not e2e' — 70 passed
• isolated Docker MCP evaluation — reward 1.0
• real Prime VM + Prime Inference MCP evaluation — reward 1.0; generated MCP Python program executed successfully, no trace errors, sandbox teardown verified

The restacked commit is signed with the contributor's verified SSH signing key. Local push hooks were skipped during the ancestry-only rewrite to avoid heavy local computation; GitHub CI is authoritative for the new commit.

[macroscopeapp]

🟡 Medium prime_agent/harness.py:40

version=".." resolves the install prefix to /var/tmp, so _bin() later executes /var/tmp/bin/prime-agent outside the version-specific cache and can collide with other runtime tooling. The pattern allows dot-only values; require a version-like alphanumeric prefix before interpolating version into these paths.

Suggested change

	version: str = Field(default="0.7.3", pattern=r"^[A-Za-z0-9._+-]+$")
	version: str = Field(default="0.7.3", pattern=r"^[A-Za-z0-9][A-Za-z0-9._+-]*$")

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @verifiers/v1/harnesses/prime_agent/harness.py around line 40:

`version=".."` resolves the install prefix to `/var/tmp`, so `_bin()` later executes `/var/tmp/bin/prime-agent` outside the version-specific cache and can collide with other runtime tooling. The pattern allows dot-only values; require a version-like alphanumeric prefix before interpolating `version` into these paths.

[macroscopeapp]

🟠 High prime_agent/harness.py:35

A failed download is treated as a successful install: curl exits nonzero, but the downstream sh exits successfully on empty input, so setup continues and only fails later when the wrapper executes the missing binary. Download the installer first so set -e propagates curl failures.

Suggested change

	curl -fsSL "$VF_PRIME_AGENT_INSTALL_URL" | sh
	curl -fsSL "$VF_PRIME_AGENT_INSTALL_URL" -o "$VF_PRIME_AGENT_DIR/.install.sh"
	sh "$VF_PRIME_AGENT_DIR/.install.sh"
	rm -f "$VF_PRIME_AGENT_DIR/.install.sh"

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @verifiers/v1/harnesses/prime_agent/harness.py around line 35:

A failed download is treated as a successful install: `curl` exits nonzero, but the downstream `sh` exits successfully on empty input, so `setup` continues and only fails later when the wrapper executes the missing binary. Download the installer first so `set -e` propagates `curl` failures.