p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

internal/dcache/dcache.go

@@ -18,7 +18,18 @@ import (
 	_ "modernc.org/sqlite"
 )
 
-const PromptVersion = "2"
+const (
+	PromptVersion   = "2"
+	ClassFleet      = "fleet"
+	ClassRestricted = "restricted"
+)
+
+func CallerClass(restricted bool) string {
+	if restricted {
+		return ClassRestricted
+	}
+	return ClassFleet
+}
 
 type DB struct {
 	sql      *sql.DB
@@ -83,18 +94,27 @@ func NormalizeQuestion(q string) string {
 	return strings.ToLower(strings.Join(strings.Fields(q), " "))
 }
 
-func DigestKey(contentHash, question, model, promptVer string) string {
-	sum := sha256.Sum256([]byte(contentHash + "\x00" + NormalizeQuestion(question) + "\x00" + model + "\x00" + promptVer))
+func DigestKey(contentHash, question, model, promptVer, callerClass string) string {
+	if callerClass == "" {
+		callerClass = ClassFleet
+	}
+	sum := sha256.Sum256([]byte(contentHash + "\x00" + NormalizeQuestion(question) + "\x00" + model + "\x00" + promptVer + "\x00" + callerClass))
 	return hex.EncodeToString(sum[:])
 }
 
-func EmbedKey(contentHash string, chunkIndex int, embedModel string) string {
-	sum := sha256.Sum256([]byte(fmt.Sprintf("%s\x00%d\x00%s", contentHash, chunkIndex, embedModel)))
+func EmbedKey(contentHash string, chunkIndex int, embedModel, callerClass string) string {
+	if callerClass == "" {
+		callerClass = ClassFleet
+	}
+	sum := sha256.Sum256([]byte(fmt.Sprintf("%s\x00%d\x00%s\x00%s", contentHash, chunkIndex, embedModel, callerClass)))
 	return hex.EncodeToString(sum[:])
 }
 
-func QuestionEmbedKey(question, embedModel string) string {
-	sum := sha256.Sum256([]byte("q\x00" + NormalizeQuestion(question) + "\x00" + embedModel))
+func QuestionEmbedKey(question, embedModel, callerClass string) string {
+	if callerClass == "" {
+		callerClass = ClassFleet
+	}
+	sum := sha256.Sum256([]byte("q\x00" + NormalizeQuestion(question) + "\x00" + embedModel + "\x00" + callerClass))
 	return hex.EncodeToString(sum[:])
 }