OpenShell policy

Status: Outline. Policy sources under policy/openshell/.

Artifact	Role
`policy/openshell/policy.yaml`	Base deny-by-default
`policy/openshell/overlays/`	channels, square, vagaro, quickbooks, inference
Generated on volume	Applied at install / connect / upgrade

Always deny: social publish APIs; payment/refund/payout/bill-pay.
Allow when connected: model endpoint; channel APIs; enabled SaaS hosts.

Apply via openshell policy set and nemohermes … policy-add / policy-remove (platform-native).