p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

internal/auth/auth.go

@@ -43,6 +43,18 @@ func Load(path string) (*Store, error) {
 
 func (s *Store) Reload() error { return s.reload() }
 
+// Callers returns a copy of the loaded caller list (names and workspaces only).
+func (s *Store) Callers() []Caller {
+	if s == nil {
+		return nil
+	}
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	out := make([]Caller, len(s.callers))
+	copy(out, s.callers)
+	return out
+}
+
 func (s *Store) reload() error {
 	b, err := os.ReadFile(s.path)
 	if err != nil {