improve setup flow: streamline steps, add pre-approval, new manage-mounts skill

- Disable sandbox by default in project settings
- Setup: remove Apple Container option (Docker only), single channel selection
  with plain text list, move fork to end, auto-set empty mounts, add command
  pre-approval step, add UTC timezone confirmation, add wait-on-user guidance,
  add 5m timeouts for long steps
- iMessage: improve Full Disk Access UX with Finder open + drag instructions
- Add /manage-mounts skill for post-setup mount configuration
- Enable iMessage channel import

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/skills/manage-mounts/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: manage-mounts
+description: Configure which host directories agent containers can access. View, add, or remove mount allowlist entries. Triggers on "mounts", "mount allowlist", "agent access to directories", "container mounts".
+---
+
+# Manage Mounts
+
+Configure which host directories NanoClaw agent containers can access. The mount allowlist lives at `~/.config/nanoclaw/mount-allowlist.json`.
+
+## Show Current Config
+
+```bash
+cat ~/.config/nanoclaw/mount-allowlist.json 2>/dev/null || echo "No mount allowlist configured"
+```
+
+Show the current config to the user in a readable format: which directories are allowed, whether non-main agents are read-only.
+
+## Add Directories
+
+Ask which directories the user wants agents to access. For each path:
+- Validate the path exists
+- Ask if it should be read-only for non-main agents (default: yes)
+
+Build the JSON config and write it:
+
+```bash
+npx tsx setup/index.ts --step mounts --force -- --json '{"allowedRoots":[{"path":"/path/to/dir","readOnly":false}],"blockedPatterns":[],"nonMainReadOnly":true}'
+```
+
+Use `--force` to overwrite the existing config.
+
+## Remove Directories
+
+Read the current config, show it, ask which entry to remove, write the updated config.
+
+## Reset to Empty
+
+```bash
+npx tsx setup/index.ts --step mounts --force -- --empty
+```
+
+## After Changes
+
+Restart the service so containers pick up the new config:
+
+- macOS: `launchctl kickstart -k gui/$(id -u)/com.nanoclaw`
+- Linux: `systemctl --user restart nanoclaw`