Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

agents/hermes/config/mcp-servers.yaml

@@ -0,0 +1,40 @@
+# agents/hermes/config/mcp-servers.yaml
+# MCP server config fragment for nemohermes onboard.
+#
+# Lists MCP servers that may be registered at S7 (SaaS connections).
+# At S3–S5, this is a placeholder — no live MCP servers are configured.
+#
+# Platform-first: MCP registration is done via nemohermes <name> mcp add,
+# not by hand-editing in-sandbox config.
+
+mcp_servers:
+  # Square — remote MCP (enabled at S7 when connected)
+  # - name: square
+  #   url: ${SQUARE_MCP_URL}
+  #   tools:
+  #     include:
+  #       - bookings.*
+  #       - customers.*
+  #       - catalog.*
+  #       - inventory.*
+  #     exclude:
+  #       - payments.*
+  #       - refunds.*
+  #       - cards.*
+  #       - checkout.*
+  #       - payouts.*
+
+  # QuickBooks Online — local MCP (enabled at S7 when connected)
+  # - name: qbo
+  #   url: http://lumina-qbo-mcp:3000  # compose service
+  #   tools:
+  #     include:
+  #       - reports.*
+  #       - search.*
+  #       - get.*
+  #     exclude:
+  #       - create_payment.*
+  #       - bill_payment.*
+  #       - write.*
+  #       - update.*
+  #       - delete.*