docs: add deniedBy to the Task 9 export list

deniedBy was introduced in Task 6's fix round to make wildcard denies work,
but the plan's export block and its exports test were never updated, so
Task 9 would have shipped it module-private.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-04-authz-permissions-implementation.md

@@ -2408,6 +2408,7 @@ describe("@wrnexus/authz exports", () => {
       "createAuthzResolver",
       "expandRoles",
       "permissionMatches",
+      "deniedBy",
       "authzMiddleware",
       "can",
       "decideFor",
@@ -2435,7 +2436,7 @@ export { memoryPermissionStore, cachedPermissionStore, scopeKey } from "./store.
 export type { PermissionStore, CachedPermissionStore, CacheOptions, GrantEffect } from "./store.ts";
 export { memoryAuditSink, consoleAuditSink, safeRecord } from "./audit.ts";
 export type { AuthzAuditEvent, AuthzAuditSink, MemoryAuditSink } from "./audit.ts";
-export { createAuthzResolver, expandRoles, permissionMatches } from "./engine.ts";
+export { createAuthzResolver, expandRoles, permissionMatches, deniedBy } from "./engine.ts";
 export type { AuthzResolver, AuthzResolverOptions, DecideInput } from "./engine.ts";
 export {
   authzMiddleware,