feat: release 2.2.1-SAC — phase 2 manifest verify and quiet SAC updates

Pinned GIT_REF/verify, release manifest, no blind reset --hard; suppress
lifecycle and watchdog Telegram during updater; healthcheck via json.dumps.

ssh-monitor-perms.sh

@@ -171,3 +171,37 @@ ssh_monitor_message_ensure_server_line() {
 		printf '%s\n🖥️ Сервер: %s\n%s' "$first" "$(ssh_monitor_server_display_name_with_ip)" "$rest"
 	fi
 }
+
+# Флаг штатного SAC/cron-update: подавляет lifecycle/watchdog Telegram на время прогона updater.
+SSH_MONITOR_UPDATE_STATE_DEFAULT="/var/lib/ssh-monitor/agent-update-in-progress"
+SSH_MONITOR_UPDATE_STATE_MAX_AGE_SEC="${SSH_MONITOR_UPDATE_STATE_MAX_AGE_SEC:-900}"
+
+ssh_monitor_update_state_file() {
+	printf '%s\n' "${SSH_MONITOR_UPDATE_STATE_FILE:-$SSH_MONITOR_UPDATE_STATE_DEFAULT}"
+}
+
+ssh_monitor_update_in_progress() {
+	local f ts now age
+	f="$(ssh_monitor_update_state_file)"
+	[ -f "$f" ] || return 1
+	ts="$(tr -d '\r\n' <"$f" 2>/dev/null || true)"
+	[[ "$ts" =~ ^[0-9]+$ ]] || return 1
+	now=$(date '+%s')
+	age=$((now - ts))
+	[ "$age" -le "$SSH_MONITOR_UPDATE_STATE_MAX_AGE_SEC" ]
+}
+
+ssh_monitor_update_mark_begin() {
+	local f dir
+	f="$(ssh_monitor_update_state_file)"
+	dir="$(dirname "$f")"
+	ssh_monitor_secure_dir "$dir" 2>/dev/null || mkdir -p "$dir" 2>/dev/null || true
+	date '+%s' >"$f"
+	ssh_monitor_secure_file "$f" 2>/dev/null || chmod 600 "$f" 2>/dev/null || true
+}
+
+ssh_monitor_update_mark_end() {
+	local f
+	f="$(ssh_monitor_update_state_file)"
+	rm -f "$f" 2>/dev/null || true
+}