Function domain_denied_explicitly 

pub fn domain_denied_explicitly(rules: &RuleSet, host: &str) -> bool

BP-10: does the DENY tier alone match host? Used only to tell the two refusal REASONS apart (“denied by” vs “not on the allowlist”) — the decision itself is always evaluate_domain’s.