Under the hood
The list of read-deny patterns for a root no longer includes negation patterns.
What
A helper function that lists the read-deny patterns configured for a given root path now filters out any pattern that starts with ! before returning the list.
Why
This keeps negation patterns (which cancel out a deny rather than adding one) from showing up as if they were themselves deny rules, which follows from the broader rework of how negated permission patterns are tracked.