p2.4: restricted workspace for permitted callers

guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.

internal/fleetctx/fleetctx.go

@@ -1,4 +1,7 @@
-// Package fleetctx is Honcho retrieval for sift. Read-only. Never guardian-star.
+// Package fleetctx is Honcho retrieval for sift. Read-only.
+// The restricted workspace (guardian-star) is reachable only when the
+// authenticated caller is in Client.Permit and the caller's mapped workspace
+// is that name. Workspace is never taken from the request.
 package fleetctx
 
 import (
@@ -17,10 +20,10 @@ import (
 )
 
 const (
-	Forbidden = "guardian-star"
-	Timeout   = 3 * time.Second
-	Limit     = 5
-	MaxChars  = 300
+	Restricted = "guardian-star"
+	Timeout    = 3 * time.Second
+	Limit      = 5
+	MaxChars   = 300
 )
 
 type Item struct {
@@ -33,6 +36,7 @@ type Item struct {
 type Client struct {
 	Base     string
 	Allow    []string
+	Permit   []string // caller names allowed to query Restricted
 	HTTP     *http.Client
 	Log      *slog.Logger
 	Calls    atomic.Uint64
@@ -40,8 +44,20 @@ type Client struct {
 	Failures atomic.Uint64
 }
 
-func refused(ws string) bool {
-	return strings.EqualFold(strings.TrimSpace(ws), Forbidden)
+func restricted(ws string) bool {
+	return strings.EqualFold(strings.TrimSpace(ws), Restricted)
+}
+
+func permitted(caller string, permit []string) bool {
+	if caller == "" {
+		return false
+	}
+	for _, p := range permit {
+		if p == caller {
+			return true
+		}
+	}
+	return false
 }
 
 var workspaceName = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
@@ -51,9 +67,6 @@ func workspaceOK(ws string) bool {
 }
 
 func allowed(ws string, allow []string) bool {
-	if refused(ws) {
-		return false
-	}
 	for _, a := range allow {
 		if a == ws {
 			return true
@@ -62,15 +75,15 @@ func allowed(ws string, allow []string) bool {
 	return false
 }
 
-// Search returns prior fleet knowledge. Failure → (nil, warning). Never an error
-// that fails the fetch. guardian-star is refused in code, not only config.
-func (c *Client) Search(ctx context.Context, workspace, query string) (items []Item, warn string) {
+// Search returns prior knowledge for workspace. Failure → (nil, warning). Never
+// an error that fails the fetch. Restricted workspace requires caller ∈ Permit.
+func (c *Client) Search(ctx context.Context, workspace, caller, query string) (items []Item, warn string) {
 	if c == nil || query == "" {
 		return nil, ""
 	}
-	if refused(workspace) {
+	if restricted(workspace) && !permitted(caller, c.Permit) {
 		if c.Log != nil {
-			c.Log.Warn("context refused", "workspace", workspace)
+			c.Log.Warn("context refused", "workspace", workspace, "caller", caller)
 		}
 		c.Failures.Add(1)
 		return nil, "context refused: workspace"