p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

docs/PLAN.md

@@ -235,9 +235,10 @@ data.
 
 - Read: `search` endpoints only (fast, no LLM). Never dialectic from sift (30–50 s of 9B
   generation, competes with the deriver).
-- Write: **none in v1.** v2 option (Kyle to decide): a one-line provenance message
-  ("<agent> read <url> for <question>") into a dedicated session of the caller's workspace,
-  so dialectic can later answer "what have we already read about X". Page content never.
+- Write: **none in v1.** If P4 provenance writes are approved: write only to the
+  caller's mapped workspace, under the same invariant as reads — a
+  `permit_restricted` caller never writes to `hermes-fleet`, and a fleet caller
+  never writes to `guardian-star`. Page content never.
 
 ## 7. Auth, secrets, config