Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

agents/hermes/config/channels.yaml

@@ -0,0 +1,16 @@
+# agents/hermes/config/channels.yaml
+# Messaging channel config fragment for nemohermes onboard.
+#
+# Channels are registered via nemohermes <name> channels add, not by
+# hand-editing in-sandbox config. This file documents the planned channels.
+#
+# Platform-first: channel mutations use nemohermes <name> channels add/stop/start.
+
+# Planned channels (enabled at S7 when connected):
+# - whatsapp
+# - telegram
+# - email
+
+# Rules:
+# - Owner ↔ agent: full messaging
+# - Client outbound: draft-first only (no silent send/publish)

agents/hermes/config/inference.yaml

@@ -0,0 +1,22 @@
+# agents/hermes/config/inference.yaml
+# Inference config fragment for nemohermes onboard.
+#
+# This fragment is merged into the sandbox's managed config during onboard.
+# Values are resolved from .env at install time.
+#
+# Platform-first: the actual config write is done by nemohermes inference set,
+# not by hand-editing in-sandbox files.
+
+# Main model endpoint (OpenAI-compatible)
+# Resolved from LUMINA_INFERENCE_BASE_URL and LUMINA_INFERENCE_MODEL
+inference:
+  provider: compatible-endpoint
+  # model: set by nemohermes inference set from .env
+  # base_url: set by nemohermes inference set from .env
+
+# Auxiliary vision model
+# Resolved from LUMINA_VISION_MODEL
+auxiliary:
+  vision:
+    # model: set from LUMINA_VISION_MODEL (often same as main if multimodal)
+    pass

agents/hermes/config/mcp-servers.yaml

@@ -0,0 +1,40 @@
+# agents/hermes/config/mcp-servers.yaml
+# MCP server config fragment for nemohermes onboard.
+#
+# Lists MCP servers that may be registered at S7 (SaaS connections).
+# At S3–S5, this is a placeholder — no live MCP servers are configured.
+#
+# Platform-first: MCP registration is done via nemohermes <name> mcp add,
+# not by hand-editing in-sandbox config.
+
+mcp_servers:
+  # Square — remote MCP (enabled at S7 when connected)
+  # - name: square
+  #   url: ${SQUARE_MCP_URL}
+  #   tools:
+  #     include:
+  #       - bookings.*
+  #       - customers.*
+  #       - catalog.*
+  #       - inventory.*
+  #     exclude:
+  #       - payments.*
+  #       - refunds.*
+  #       - cards.*
+  #       - checkout.*
+  #       - payouts.*
+
+  # QuickBooks Online — local MCP (enabled at S7 when connected)
+  # - name: qbo
+  #   url: http://lumina-qbo-mcp:3000  # compose service
+  #   tools:
+  #     include:
+  #       - reports.*
+  #       - search.*
+  #       - get.*
+  #     exclude:
+  #       - create_payment.*
+  #       - bill_payment.*
+  #       - write.*
+  #       - update.*
+  #       - delete.*