SHA-addressed reads in the movilba-web shared checkout: PreToolUse deny-hook

Adopted from blackboard bb-pm-mba-l-cc-mto5z5o7-bn5655, Elazar GO relayed by pm-mba-l-cc 2026-09-05. Owner bin-lezama-cc. SHIPPED (untracked, awaiting commit decision): .claude/hooks/sha-read-gate.sh v1.0 + .claude/settings.json PreToolUse hook, matcher Read|Grep|Glob|Bash, timeout 10s. Denies a bare read of any path under the shared-checkout root that is dirty (git status --porcelain -- path non-empty) or whose content at HEAD differs from dev/dev. Denial names the fix (git show ref:path). git show/diff/log always permitted. Private worktrees exempt via git worktree list. Fails OPEN on unparsed input, missing jq, moved root or unfetched ref - it steers a habit and every denied byte is one git show away, so a gate that fails closed on its own bugs would block work it was never meant to judge. SEVEN CONTROLS, all pass: clean+dev-equal file allows; file differing from dev/dev denies; untracked dirty file denies; git show allows; cat on a denied path denies; path outside the root allows; private worktree allows. MEASURED BLAST RADIUS at time of filing: the shared root is on branch movilba-97-modification-subtype at a78225f8, 12 ahead / 208 BEHIND dev/dev. 190 of 717 tracked files differ from dev/dev, 150 porcelain entries dirty - roughly a quarter of the tree denies on the ref clause alone. Intended steer, not a defect, but it lands the moment lanes restart. COST: 102 ms added per gated tool call, measured over 20 invocations. NOT DONE: hook not committed. It is a tracked-file change to a shared repo and it changes every lane behaviour at their next session start, so it wants pm sign-off on TIMING, not just on mechanism. Follow-ups filed separately: coder03-mba-l-cc hub-side send precheck rejecting a path-with-no-SHA message; coder-mba-l-ca handoff wrapper carrying the SHA.