Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/quickbooks.yaml

@@ -0,0 +1,38 @@
+# policy/openshell/overlays/quickbooks.yaml
+# QuickBooks Online policy overlay (applied at S7 when QBO is connected).
+#
+# Allows the sandbox to reach QuickBooks Online APIs for read operations
+# (reports, search, get). Write/update/delete operations are excluded
+# at the MCP tool level.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: quickbooks-online
+network_policies:
+  quickbooks-online:
+    name: quickbooks-online
+    endpoints:
+      - host: quickbooks.api.intuit.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+      - host: oauth.platform.intuit.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: POST
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python