Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.

scripts/README.md

@@ -1,6 +1,6 @@
 # Host scripts
 
-**Status:** S0b–S2 implemented. S3–S7 pending.
+**Status:** S0b–S5 implemented. S6–S7 pending.
 
 All scripts wrap **`nemohermes` / `openshell` / Docker**. No parallel control API.
 
@@ -9,9 +9,11 @@ All scripts wrap **`nemohermes` / `openshell` / Docker**. No parallel control AP
 | Script | Role | Status |
 |--------|------|--------|
 | `bootstrap.sh` | Host prereqs; install Docker if missing | ✅ S0b |
-| `install.sh` | Staged installer (S0b–S2) | ✅ S0b–S2 |
+| `install.sh` | Staged installer (S0b–S5) | ✅ S0b–S5 |
 | `install/s1-env.sh` | S1: create/validate `.env` | ✅ S1 |
 | `install/s2-models.sh` | S2: model + vision config + smoke | ✅ S2 |
+| `install/s4-sandbox.sh` | S4: sandbox verify (attach) or onboard | ✅ S4 |
+| `install/s5-policy-skills.sh` | S5: policy overlays + skills sync | ✅ S5 |
 | `upgrade.sh` | Snapshot, pull pins, migrate, re-apply policy, doctor | ⏳ Pending |
 | `doctor.sh` | Health checks | ⏳ Pending |
 | `connect/*.sh` | Operator connect helpers (Square, QBO, Vagaro, channels) | ⏳ Pending |
@@ -30,18 +32,23 @@ All scripts wrap **`nemohermes` / `openshell` / Docker**. No parallel control AP
 # Bootstrap (Docker if missing)
 ./scripts/bootstrap.sh
 
-# Full install (S0b–S2)
+# Full install (S0b–S5)
 ./scripts/install.sh
 
 # Individual stages
 ./scripts/install.sh --stage s1   # env only
 ./scripts/install.sh --stage s2   # models only
+./scripts/install.sh --stage s4   # sandbox verify/onboard
+./scripts/install.sh --stage s5   # policy + skills
+./scripts/install.sh --stage s3-s5 # S3 through S5
 
 # Or via Make
 make bootstrap
 make install
 make install-s1
 make install-s2
+make install-s3-s5
+make install-s5
 ```
 
 ## Design reference