improve setup flow: streamline steps, add pre-approval, new manage-mounts skill

- Disable sandbox by default in project settings
- Setup: remove Apple Container option (Docker only), single channel selection
  with plain text list, move fork to end, auto-set empty mounts, add command
  pre-approval step, add UTC timezone confirmation, add wait-on-user guidance,
  add 5m timeouts for long steps
- iMessage: improve Full Disk Access UX with Finder open + drag instructions
- Add /manage-mounts skill for post-setup mount configuration
- Enable iMessage channel import

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/skills/setup/setup-permissions.json

@@ -0,0 +1,26 @@
+[
+  "Bash(bash setup.sh*)",
+  "Bash(git remote *)",
+  "Bash(npx tsx setup/index.ts*)",
+  "Bash(npx tsx scripts/init-first-agent.ts*)",
+  "Bash(npm install chat-adapter-*)",
+  "Bash(npm ci*)",
+  "Bash(npm run build*)",
+  "Bash(curl -fsSL onecli.sh*)",
+  "Bash(onecli *)",
+  "Bash(grep -q *)",
+  "Bash(echo *>> .env)",
+  "Bash(ls *)",
+  "Bash(cat ~/.config/nanoclaw/*)",
+  "Bash(tail *logs/*)",
+  "Bash(launchctl *nanoclaw*)",
+  "Bash(sqlite3 data/*)",
+  "Bash(docker info*)",
+  "Bash(docker logs *)",
+  "Bash(mkdir -p *)",
+  "Bash(cp .env *)",
+  "Bash(xattr *)",
+  "Bash(find ~/.npm *)",
+  "Bash(which onecli*)",
+  "Bash(./container/build.sh*)"
+]