[P2-E8.2] Confiqure Permissioned Dedicated synchronizers

**Context.** Dedicated synchronizers start permissioned (`onboardingRestriction =
RestrictedOpen` at bootstrap). Splice exposes the switch on the gsync path only; the
dedicated-sync bring-up needs the equivalent. MVP: the operator permissions nodes
manually.

**Deliverable.** Bootstrap sets RestrictedOpen; operator flow (console verb or app
endpoint) to admit a participant; documented MVP limitation (manual admission) for DA
validation.

**Acceptance.** Un-admitted participant cannot join on LocalNet; admission flow admits;
restriction survives restart.

**Depends on.** P2-E8.1.

—
Epic: #71 · Plan: [P2-E8-deployment-ops.md](https://github.com/ChainSafe/canton-extending-mainnet/blob/main/docs/planning/phase-2-epics/P2-E8-deployment-ops.md)