Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

policy/openshell/overlays/vagaro.yaml

@@ -0,0 +1,33 @@
+# policy/openshell/overlays/vagaro.yaml
+# Vagaro policy overlay (applied at S7 when Vagaro is connected).
+#
+# Allows the sandbox to reach Vagaro's REST API for appointments, clients,
+# services, and staff data. Webhook ingestion is handled by the local
+# vagaro-webhooks service (compose-managed), not direct sandbox egress.
+#
+# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes
+
+preset:
+  name: vagaro
+network_policies:
+  vagaro:
+    name: vagaro
+    endpoints:
+      - host: api.vagaro.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+          - allow:
+              method: PUT
+              path: /**
+    binaries:
+      - path: /usr/local/bin/hermes
+      - path: /usr/bin/python3*
+      - path: /opt/hermes/.venv/bin/python