fix: enforce SAC git URL when updating ssh-monitor agents (0.20.8)

Pass REPO_URL/GIT_BRANCH from agent settings over SSH, preflight git remotes on stale hosts, and stop using GitHub origin on routers.

backend/app/services/agent_update.py

@@ -146,6 +146,7 @@ def run_linux_agent_update_fallback(
     cfg_linux,
     *,
     repo_url: str | None = None,
+    git_branch: str | None = None,
 ) -> tuple[bool, str, str | None]:
     if not is_linux_host(host):
         return False, "Host is not Linux", None
@@ -160,12 +161,14 @@ def run_linux_agent_update_fallback(
         return False, str(exc), None
 
     effective_repo = (repo_url or "").strip() or None
+    effective_branch = (git_branch or "main").strip() or "main"
     for target in targets:
         result = run_ssh_monitor_update(
             target=target,
             user=cfg_linux.user,
             password=cfg_linux.password,
             repo_url=effective_repo,
+            git_branch=effective_branch,
         )
         last_message = result.message
         if result.ok:
@@ -217,7 +220,13 @@ def execute_agent_update_fallback(db: Session, host: Host) -> tuple[bool, str, s
         linux_cfg = get_effective_linux_admin_config(db)
         agent_cfg = get_effective_agent_update_config(db)
         repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
-        ok, message, version = run_linux_agent_update_fallback(host, linux_cfg, repo_url=repo_url)
+        branch = (agent_cfg.git_branch or "main").strip() or "main"
+        ok, message, version = run_linux_agent_update_fallback(
+            host,
+            linux_cfg,
+            repo_url=repo_url,
+            git_branch=branch,
+        )
     elif product == PRODUCT_RDP or is_windows_host(host):
         win_cfg = get_effective_win_admin_config(db)
         ok, message, version = run_windows_agent_update_fallback(host, win_cfg, cfg.win_agent_update_script)