fix: suppress sudo Telegram during SAC agent update (2.2.3-SAC)

Whitelist SAC maintenance commands in ssh-monitor-perms and monitor_sudo; pre-commit uses working python on Windows.

contrib/hooks/pre-commit

@@ -33,12 +33,23 @@ _agent_files_staged() {
 
 _version_bump_staged || _agent_files_staged || exit 0
 
-if ! command -v python3 >/dev/null 2>&1; then
-	echo "pre-commit: python3 нужен для manifest" >&2
-	exit 1
-fi
+_find_python() {
+	local c
+	for c in python3 python; do
+		if command -v "$c" >/dev/null 2>&1 && "$c" -c 'import sys' >/dev/null 2>&1; then
+			echo "$c"
+			return 0
+		fi
+	done
+	return 1
+}
 
-python3 "$ROOT/contrib/manifest/generate.py"
+PY="$(_find_python)" || {
+	echo "pre-commit: python нужен для manifest (рабочий python/python3 не найден)" >&2
+	exit 1
+}
+
+"$PY" "$ROOT/contrib/manifest/generate.py"
 VER="$(tr -d '\r\n' <"$ROOT/version.txt")"
 [ -n "$VER" ] || {
 	echo "pre-commit: version.txt пуст — не могу добавить manifest" >&2