Function sorted_snapshot 

pub fn sorted_snapshot(
    rules: Vec<Arc<QueryDenyRule>>,
) -> Arc<[Arc<QueryDenyRule>]> 

Sorts rules by (created_at, rule_id), oldest first, and wraps them into a DenySnapshot – pub so tests can build one directly, matching the invariant QueryDenyList::refresh and QueryDenyList::insert maintain internally.