Function render_declared_ungranted_warning 

pub fn render_declared_ungranted_warning(ids: &[String]) -> String

A second line, printed right after the header, naming capability classes the component declared in act.toml that resolved to deny anyway (no grant covered them, or an operator explicitly denied them). Restricted to declared == true classes by the caller — every class a component never asked for also resolves to deny, and warning on those would bury the one signal an operator actually needs to see.