Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/square-mcp.yaml

@@ -0,0 +1,30 @@
+# policy/openshell/overlays/square-mcp.yaml
+# Square MCP policy overlay (applied at S7 when Square is connected).
+#
+# Allows the sandbox to reach Square's MCP server for bookings, customers,
+# catalog, and inventory reads. Payment/refund/payout tools are excluded
+# at the MCP tool level, not the network level.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: square-mcp
+network_policies:
+  square-mcp:
+    name: square-mcp
+    endpoints:
+      - host: connect.squareup.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python