p2.6: warn when permit_restricted has no key

CheckMappings now logs WARN for each permit_restricted name missing
from keys.toml, so a missing straylight-gs key is visible at start
and on reload instead of passing silently.

internal/fleetctx/fleetctx.go

@@ -193,16 +193,26 @@ type CallerWS struct {
 	Name, Workspace string
 }
 
-// CheckMappings logs ERROR for every permitted caller whose workspace is not Restricted.
+// CheckMappings logs ERROR for every permitted caller whose workspace is not
+// Restricted, and WARN for every permit_restricted name with no key at all.
 func (c *Client) CheckMappings(callers []CallerWS) {
 	if c == nil {
 		return
 	}
+	have := make(map[string]struct{}, len(callers))
 	for _, a := range callers {
+		have[a.Name] = struct{}{}
 		if permitted(a.Name, c.Permit) && !restricted(a.Workspace) {
 			if c.Log != nil {
 				c.Log.Error("restricted caller mapped off guardian-star", "caller", a.Name, "workspace", a.Workspace)
 			}
 		}
 	}
+	for _, name := range c.Permit {
+		if _, ok := have[name]; !ok {
+			if c.Log != nil {
+				c.Log.Warn("permit_restricted caller has no key", "caller", name)
+			}
+		}
+	}
 }