p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

internal/api/api.go

@@ -17,6 +17,7 @@ import (
 
 	"git.wntrmute.dev/kyle/sift/internal/auth"
 	"git.wntrmute.dev/kyle/sift/internal/clean"
+	"git.wntrmute.dev/kyle/sift/internal/dcache"
 	"git.wntrmute.dev/kyle/sift/internal/digest"
 	"git.wntrmute.dev/kyle/sift/internal/fetch"
 	"git.wntrmute.dev/kyle/sift/internal/fleetctx"
@@ -308,7 +309,7 @@ func (s *Server) v1fetch(w http.ResponseWriter, r *http.Request) {
 			content, warn = capDigestFallback(content, warn)
 			digMeta = map[string]any{"fallback": "unset"}
 		} else {
-			dr := s.Digest.Run(r.Context(), content, q, res.FinalURL)
+			dr := s.Digest.Run(r.Context(), content, q, res.FinalURL, s.callerClass(c))
 			digestMS = dr.DigestMS
 			if dr.Fallback != "" {
 				warn = append(warn, "digest fell back to clean: "+dr.Fallback)
@@ -595,6 +596,10 @@ func (s *Server) restrictedLog(c *auth.Caller) bool {
 	return c != nil && permittedCaller(c.Name, s.PermitRestricted)
 }
 
+func (s *Server) callerClass(c *auth.Caller) string {
+	return dcache.CallerClass(s.restrictedLog(c))
+}
+
 // logReason is the reason field for fetch error logs. Restricted callers get a
 // coarse class so the hostname in guard messages does not land in the journal.
 func (s *Server) logReason(c *auth.Caller, fe *fetch.Error) string {