Function peer_policy_denies 

pub fn peer_policy_denies(
    allowed: &[String],
    identities: &[&str],
    match_fn: impl Fn(&str, &str) -> bool,
) -> bool

Whether any deny entry in a resolved peer list names any of identities.

Lives here rather than beside the channel allowlist because channel_external_peers produces the encoding, and consumers outside zeroclaw-channels have to decode it the same way. The plugin ingress in zeroclaw-runtime is one: zeroclaw-channels depends on zeroclaw-runtime, so it cannot reach back for the helper, and a second implementation of deny precedence on an authorization surface is the drift this codec exists to prevent.