p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

internal/fleetctx/fleetctx.go

@@ -76,11 +76,20 @@ func allowed(ws string, allow []string) bool {
 }
 
 // Search returns prior knowledge for workspace. Failure → (nil, warning). Never
-// an error that fails the fetch. Restricted workspace requires caller ∈ Permit.
+// an error that fails the fetch.
+// Restricted workspace requires caller ∈ Permit. A permitted caller whose mapped
+// workspace is not Restricted is refused and never queried (no fallback).
 func (c *Client) Search(ctx context.Context, workspace, caller, query string) (items []Item, warn string) {
 	if c == nil || query == "" {
 		return nil, ""
 	}
+	if permitted(caller, c.Permit) && !restricted(workspace) {
+		if c.Log != nil {
+			c.Log.Error("restricted caller mapped off guardian-star", "caller", caller, "workspace", workspace)
+		}
+		c.Failures.Add(1)
+		return nil, "context refused: workspace"
+	}
 	if restricted(workspace) && !permitted(caller, c.Permit) {
 		if c.Log != nil {
 			c.Log.Warn("context refused", "workspace", workspace, "caller", caller)
@@ -178,3 +187,22 @@ func Query(question, title string, headings []string) string {
 }
 
 func (c *Client) String() string { return fmt.Sprintf("fleetctx base=%s", c.Base) }
+
+// CallerWS is a keys.toml name+workspace pair for startup/reload checks.
+type CallerWS struct {
+	Name, Workspace string
+}
+
+// CheckMappings logs ERROR for every permitted caller whose workspace is not Restricted.
+func (c *Client) CheckMappings(callers []CallerWS) {
+	if c == nil {
+		return
+	}
+	for _, a := range callers {
+		if permitted(a.Name, c.Permit) && !restricted(a.Workspace) {
+			if c.Log != nil {
+				c.Log.Error("restricted caller mapped off guardian-star", "caller", a.Name, "workspace", a.Workspace)
+			}
+		}
+	}
+}