adapt to new deny behavior

[mkhl]

Since direnv/direnv#1158 (included in release 2.33.0), direnv no longer complains when a .envrc files is blocked. I need to adapt that codepath and its tests so we can react to blocked files and set up the appropriate watches.