p2.4: restricted workspace for permitted callers

guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.

internal/api/api.go

@@ -330,7 +330,7 @@ func (s *Server) v1fetch(w http.ResponseWriter, r *http.Request) {
 	if wantCtx && s.Ctx != nil {
 		ct0 := time.Now()
 		query := fleetctx.Query(q, cl.Title, headings(cl.Markdown))
-		items, cw := s.Ctx.Search(r.Context(), c.Workspace, query)
+		items, cw := s.Ctx.Search(r.Context(), c.Workspace, c.Name, query)
 		ctxMS = time.Since(ct0).Milliseconds()
 		if cw != "" {
 			warn = append(warn, cw)