#4308 Warn when a grant with a methods list is a deny: it also refuses requests that name no method

Follow-up to swamp-club#4226. A deny with a methods list refuses every request to its resource that names no method, as well as requests for the listed methods. That covers model.get, model edit and delete, restricted commands, the access:* admin fallback, and datastore data and output commits from any run of that behavior. This is deliberate: the request cannot show which method it serves, and for a team member's local run the commit is the only place serve can apply the deny. It is also how scoped denies behaved before #4226. But an operator who writes a narrow deny such as deny run model:prod methods:[destroy] will not expect it to block every data commit for prod. Suggestion: swamp access grant create, grant files and the policy snapshot loader print a warning for a scoped deny that says this, the same way findGrantMethodIssues (src/domain/access/grant_methods.ts) reports methods on workflow and data grants. Raised by the #4226 verification reviews.