Function capability_is_denied 

pub fn capability_is_denied(
    deny: &BTreeSet<Capability>,
    cap: &Capability,
) -> bool

Whether a policy deny set blocks cap, honoring superset denies.

A FileWrite deny also blocks FileDelete: policies authored before FileDelete existed (AAASM-4103) expressed “no mutation” as a single file_write deny, and that intent must keep blocking delete — a stale write-deny must never leak delete (fail-closed migration). The converse is deliberately absent: a FileWrite allow never grants FileDelete; delete requires an explicit file_delete allow. Net effect: the new verb can only ever make delete more restricted than before, never less.

Requires the alloc feature.