Function build_denial_warn_line 

pub fn build_denial_warn_line(
    rule_id: &str,
    reason: &str,
    sql_hash: &str,
    user: &str,
    email: &str,
    client: &str,
    entrypoint: &str,
    client_ip: &str,
    query_id: &str,
) -> String

Builds the warn! line for a query-deny-list denial: the rule id, its reason, the query’s normalized fingerprint, the caller’s identity/client attribution, and the query_id. pub so a test can assert its content directly, the same way build_log_line’s content is asserted, rather than by capturing log output.