Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/inference.yaml

@@ -0,0 +1,49 @@
+# policy/openshell/overlays/inference.yaml
+# Inference endpoint policy overlay for Lumina.
+#
+# Allows the sandbox to reach the configured inference endpoint through
+# the OpenShell gateway. The gateway resolves inference.local to the
+# actual endpoint URL from .env.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+#
+# This overlay is additive — it does not remove existing presets.
+
+preset:
+  name: lumina-inference
+network_policies:
+  lumina-inference:
+    name: lumina-inference
+    endpoints:
+      - host: inference.local
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: POST
+              path: /v1/chat/completions
+          - allow:
+              method: POST
+              path: /v1/messages
+          - allow:
+              method: POST
+              path: /v1/responses
+          - allow:
+              method: POST
+              path: /v1/completions
+          - allow:
+              method: POST
+              path: /v1/embeddings
+          - allow:
+              method: GET
+              path: /v1/models
+          - allow:
+              method: GET
+              path: /v1/models/**
+    binaries:
+      - path: /usr/local/bin/hermes
+      # Glob supported by nemohermes policy engine (verified against built-in
+      # presets: huggingface, nous_research, npm_yarn, pypi all use python3*)
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python