Function ensure_standing 

pub fn ensure_standing(
    standing: ShareStanding,
    min: ShareStanding,
    subject: &str,
    file_id: &str,
) -> ClResult<()>

Enforce a minimum standing, with the denial log every call site wants.

Shared by the require_* wrappers and by callers that need the ShareStanding itself (ref listing uses it to decide redaction), so there is one deny path rather than several.