Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

deploy/compose/docker-compose.yml

@@ -0,0 +1,55 @@
+# Salon_Assistant / Lumina — optional product services
+#
+# This compose file is OPTIONAL. It is NOT required for the S3–S5 UAT attach path.
+# OpenShell manages the Hermes sandbox container directly; nemohermes owns
+# sandbox lifecycle (start/stop/rebuild/destroy). This compose file exists only
+# for future local MCP processes and webhook services that run alongside the
+# sandbox on the same Docker network.
+#
+# Usage (when needed):
+#   cd deploy/compose && docker compose up -d
+#
+# See deploy/compose/README.md for details.
+
+# ── Network ────────────────────────────────────────────────────────────────
+# All product-managed services share this network. The Hermes sandbox container
+# is NOT defined here — it is managed by nemohermes/OpenShell.
+networks:
+  lumina:
+    driver: bridge
+
+# ── Volumes ────────────────────────────────────────────────────────────────
+volumes:
+  qbo-mcp-data:
+  vagaro-webhooks-data:
+
+# ── Services (stubs — enabled when SaaS connections are configured) ────────
+# Uncomment and configure when the corresponding SaaS integration is connected.
+
+# qbo-mcp:
+#   image: ghcr.io/ty-tech/qbo-mcp:latest  # placeholder — real image at S7
+#   container_name: lumina-qbo-mcp
+#   networks:
+#     - lumina
+#   volumes:
+#     - qbo-mcp-data:/data
+#   environment:
+#     - QBO_CLIENT_ID=${QBO_CLIENT_ID}
+#     - QBO_CLIENT_SECRET=${QBO_CLIENT_SECRET}
+#     - QBO_REFRESH_TOKEN=${QBO_REFRESH_TOKEN}
+#     - QBO_REALM_ID=${QBO_REALM_ID}
+#   restart: unless-stopped
+
+# vagaro-webhooks:
+#   image: ghcr.io/ty-tech/vagaro-webhooks:latest  # placeholder — real image at S7
+#   container_name: lumina-vagaro-webhooks
+#   networks:
+#     - lumina
+#   volumes:
+#     - vagaro-webhooks-data:/data
+#   environment:
+#     - VAGARO_API_KEY=${VAGARO_API_KEY}
+#     - VAGARO_WEBHOOK_SECRET=${VAGARO_WEBHOOK_SECRET}
+#   ports:
+#     - "127.0.0.1:8090:8080"
+#   restart: unless-stopped