fix: suppress sudo Telegram during SAC agent update (2.2.3-SAC)

Whitelist SAC maintenance commands in ssh-monitor-perms and monitor_sudo; pre-commit uses working python on Windows.

ssh-monitor-perms.sh

@@ -205,3 +205,19 @@ ssh_monitor_update_mark_end() {
 	f="$(ssh_monitor_update_state_file)"
 	rm -f "$f" 2>/dev/null || true
 }
+
+# SAC/cron update: не слать sudo-alert на штатные команды updater/bootstrap.
+ssh_monitor_sudo_is_sac_maintenance() {
+	local cmd="$1"
+	[ -n "$cmd" ] || return 1
+	if ssh_monitor_update_in_progress 2>/dev/null; then
+		return 0
+	fi
+	case "$cmd" in
+	*update_ssh_monitor.sh* | *UPDATE_VIA_SAC* | *update_script.log* | \
+		*"/opt/scripts/update"*"ssh-monitor"* | *agent-update-in-progress*)
+		return 0
+		;;
+	esac
+	return 1
+}