Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/channels.yaml

@@ -0,0 +1,18 @@
+# policy/openshell/overlays/channels.yaml
+# Messaging channels policy overlay (applied at S7 when channels are connected).
+#
+# Allows the sandbox to reach messaging channel APIs. Each channel has
+# its own built-in preset in nemohermes (telegram, whatsapp, slack, etc.).
+# This overlay documents which channels Lumina uses.
+#
+# Apply via: nemohermes <name> policy-add <preset-name> --yes
+# (Built-in presets; no --from-file needed for standard channels)
+#
+# Planned channels:
+#   - whatsapp  (nemohermes built-in preset)
+#   - telegram  (nemohermes built-in preset)
+#   - email     (handled by openshell provider store)
+#
+# Rules:
+#   - Owner ↔ agent: full messaging
+#   - Client outbound: draft-first only (no silent send/publish)

policy/openshell/overlays/inference.yaml

@@ -0,0 +1,49 @@
+# policy/openshell/overlays/inference.yaml
+# Inference endpoint policy overlay for Lumina.
+#
+# Allows the sandbox to reach the configured inference endpoint through
+# the OpenShell gateway. The gateway resolves inference.local to the
+# actual endpoint URL from .env.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+#
+# This overlay is additive — it does not remove existing presets.
+
+preset:
+  name: lumina-inference
+network_policies:
+  lumina-inference:
+    name: lumina-inference
+    endpoints:
+      - host: inference.local
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: POST
+              path: /v1/chat/completions
+          - allow:
+              method: POST
+              path: /v1/messages
+          - allow:
+              method: POST
+              path: /v1/responses
+          - allow:
+              method: POST
+              path: /v1/completions
+          - allow:
+              method: POST
+              path: /v1/embeddings
+          - allow:
+              method: GET
+              path: /v1/models
+          - allow:
+              method: GET
+              path: /v1/models/**
+    binaries:
+      - path: /usr/local/bin/hermes
+      # Glob supported by nemohermes policy engine (verified against built-in
+      # presets: huggingface, nous_research, npm_yarn, pypi all use python3*)
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python

policy/openshell/overlays/quickbooks.yaml

@@ -0,0 +1,38 @@
+# policy/openshell/overlays/quickbooks.yaml
+# QuickBooks Online policy overlay (applied at S7 when QBO is connected).
+#
+# Allows the sandbox to reach QuickBooks Online APIs for read operations
+# (reports, search, get). Write/update/delete operations are excluded
+# at the MCP tool level.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: quickbooks-online
+network_policies:
+  quickbooks-online:
+    name: quickbooks-online
+    endpoints:
+      - host: quickbooks.api.intuit.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+      - host: oauth.platform.intuit.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: POST
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python

policy/openshell/overlays/square-mcp.yaml

@@ -0,0 +1,30 @@
+# policy/openshell/overlays/square-mcp.yaml
+# Square MCP policy overlay (applied at S7 when Square is connected).
+#
+# Allows the sandbox to reach Square's MCP server for bookings, customers,
+# catalog, and inventory reads. Payment/refund/payout tools are excluded
+# at the MCP tool level, not the network level.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: square-mcp
+network_policies:
+  square-mcp:
+    name: square-mcp
+    endpoints:
+      - host: connect.squareup.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python

policy/openshell/overlays/vagaro.yaml

@@ -0,0 +1,33 @@
+# policy/openshell/overlays/vagaro.yaml
+# Vagaro policy overlay (applied at S7 when Vagaro is connected).
+#
+# Allows the sandbox to reach Vagaro's REST API for appointments, clients,
+# services, and staff data. Webhook ingestion is handled by the local
+# vagaro-webhooks service (compose-managed), not direct sandbox egress.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: vagaro
+network_policies:
+  vagaro:
+    name: vagaro
+    endpoints:
+      - host: api.vagaro.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+          - allow:
+              method: PUT
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python