p2.6: warn when permit_restricted has no key

CheckMappings now logs WARN for each permit_restricted name missing
from keys.toml, so a missing straylight-gs key is visible at start
and on reload instead of passing silently.

docs/P2.md

@@ -110,8 +110,9 @@ under size cap; corrupt DB → warn and bypass.
   A fleet caller remapped to it is still refused (tested). **P2.6 reverse:** a
   `permit_restricted` caller whose mapped workspace is not `guardian-star` is
   refused (ERROR log, no Honcho request, never fall back to `hermes-fleet`).
-  Checked at Search, at serve start, and on keys reload. Workspace is never taken
-  from the request.
+  Checked at Search, at serve start, and on keys reload. A `permit_restricted`
+  name with no key at all logs WARN (missing key does not pass silently).
+  Workspace is never taken from the request.
 - Query: the question if given, else title + top 3 headings.
 - Return trimmed items: `{peer, content (≤300 chars), created_at, session}`; label clearly
   as prior fleet knowledge, not page content.