p2.6: partition dcache by caller class; pin restricted workspace

Digest, chunk-embed, and question-embed keys include fleet|restricted so
a fleet caller cannot observe a restricted cache hit. Digest.Run takes
the class from permit_restricted.

A permit_restricted caller whose keys.toml workspace is not
guardian-star is refused at Search (no Honcho request) and flagged at
serve start and keys reload.

docs: P3 restricted callers search like the fleet; cache/logs isolate.

internal/fleetctx/fleetctx_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 )
@@ -30,6 +31,29 @@ func TestRestrictedRefusedWhenFleetCallerRemapped(t *testing.T) {
 	}
 }
 
+func TestRestrictedCallerMappedToFleetMakesNoRequest(t *testing.T) {
+	var hits atomic.Int32
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		w.WriteHeader(200)
+		_, _ = w.Write([]byte("[]"))
+	}))
+	defer ts.Close()
+	c := &Client{
+		Base:   ts.URL,
+		Allow:  []string{"guardian-star", "hermes-fleet"},
+		Permit: []string{"straylight-gs"},
+		HTTP:   ts.Client(),
+	}
+	items, warn := c.Search(context.Background(), "hermes-fleet", "straylight-gs", "secret query")
+	if hits.Load() != 0 {
+		t.Fatalf("honcho hits %d", hits.Load())
+	}
+	if len(items) != 0 || warn == "" {
+		t.Fatalf("items %v warn %q", items, warn)
+	}
+}
+
 func TestRestrictedAllowedForPermittedCaller(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/v3/workspaces/guardian-star/search" {