Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/channels.yaml

@@ -0,0 +1,18 @@
+# policy/openshell/overlays/channels.yaml
+# Messaging channels policy overlay (applied at S7 when channels are connected).
+#
+# Allows the sandbox to reach messaging channel APIs. Each channel has
+# its own built-in preset in nemohermes (telegram, whatsapp, slack, etc.).
+# This overlay documents which channels Lumina uses.
+#
+# Apply via: nemohermes <name> policy-add <preset-name> --yes
+# (Built-in presets; no --from-file needed for standard channels)
+#
+# Planned channels:
+#   - whatsapp  (nemohermes built-in preset)
+#   - telegram  (nemohermes built-in preset)
+#   - email     (handled by openshell provider store)
+#
+# Rules:
+#   - Owner ↔ agent: full messaging
+#   - Client outbound: draft-first only (no silent send/publish)