p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

cmd/sift/serve.go

@@ -123,6 +123,11 @@ func serveMain() {
 			allow = []string{"hermes-fleet"}
 		}
 		srv.Ctx = &fleetctx.Client{Base: cfg.Context.Honcho, Allow: allow, Permit: cfg.Context.PermitRestricted, Log: log}
+		var maps []fleetctx.CallerWS
+		for _, a := range store.Callers() {
+			maps = append(maps, fleetctx.CallerWS{Name: a.Name, Workspace: a.Workspace})
+		}
+		srv.Ctx.CheckMappings(maps)
 	}
 	if len(cfg.SelfIP.Sources) > 0 {
 		disc := &selfip.Discoverer{
@@ -162,6 +167,13 @@ func serveMain() {
 				log.Error("keys reload", "err", err)
 			} else {
 				log.Info("keys reloaded")
+				if srv.Ctx != nil {
+					var maps []fleetctx.CallerWS
+					for _, a := range store.Callers() {
+						maps = append(maps, fleetctx.CallerWS{Name: a.Name, Workspace: a.Workspace})
+					}
+					srv.Ctx.CheckMappings(maps)
+				}
 			}
 		}
 	}()