Read-only git history primitive for sh.git (git-history-deleted.sh)

git-history-deleted.sh v1.0 SHIPPED (sh.git 1f07e12). The first sanctioned read-only history primitive in the fleet. WHY IT EXISTS: git-workflow.md:15 bans ALL manual git commands, read-only log/diff/status included. That ban is right for the write path and it made a whole class of question unanswerable - OPS-171's own first action needed --diff-filter=D and no permitted route provided it. Checked before proposing: none of the 26 git*.sh in sh.git exposes history, gitpush.sh v4.57 has no inspect mode, gitmerge.sh v1.14 takes only --newest/--ours/--theirs. Missing primitive, not a rule needing an exemption - the fleet's own verify-the-primitive rule applied to itself. READ-ONLY BY CONSTRUCTION, not by promise: every git call routes through git_ro(), which refuses any subcommand outside a five-entry allowlist (log, ls-tree, cat-file, rev-parse, rev-list). No fetch, no checkout, no reset, no write path in the file. Adding one means defeating git_ro deliberately, which shows up in a diff; 'we were careful' does not. SUBCOMMANDS: deletions (what was deleted, in which commit), exists <path> (is it at the ref now), readback (both, per path - the OPS-171 question), --self-check. THE LOAD-BEARING CAVEAT, printed on every run: origin/main is a LOCAL ref - a snapshot from the last fetch, not a view of the remote. Since the script may not fetch, every answer is scoped to what this host last synced. It dates that from FETCH_HEAD mtime and warns past 24h. Tip commit date and last fetch time are DIFFERENT quantities and only the second bounds staleness - a tip 5 minutes old can sit behind a week-old fetch. Same shape as OPS-216: a process answering confidently from a stale snapshot of a file that has since changed. SELF-CHECK FORCES THREE ARMS and all three pass: a path that exists reports present, a path that cannot exist reports absent, and a non-allowlisted subcommand is refused. A control not seen to fail is a green line. Host-neutral, no $(hostname), one file three hosts. bin-whey-cc + bin-lezama-cc DMed to pull.