Docs: Explain contract capability gates

skills/panama-desktop/SKILL.md

@@ -40,7 +40,13 @@ Other tools that beat raw commands:
 - `panama-launch --class '<regex>' -- cmd…` — focus the window if it exists, launch otherwise
 - `panama-sudo --reason "why" -- cmd…` — root work; load the `panama-sudo` skill first
 - `panama update` — bring the machine current (pull, repairs, unattended stages); asks nothing
-- `panama test --safe` — verify the desktop's contracts without hijacking the session
+- `panama test --safe` — run only contracts classified as hermetic in
+  `tests/contracts.manifest`
+
+A plain `panama test` prompts in a terminal before it starts non-hermetic contracts. Automation
+must grant each required capability with a repeatable `--allow`, such as
+`panama test --allow live-host updates`. Each contract has a 180-second outer timeout by default,
+and failures print captured stdout and stderr.
 
 ## Settings