fix: harden push-github-snapshot URL rewrite and README header

scripts/push-github-snapshot.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/usr/bin/env bash
 # Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей.
 set -Eeuo pipefail
 
@@ -33,10 +33,12 @@ echo "[snapshot] rewrite hosts and internal URLs"
 apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
 apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
 apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
+apply_sed 's#git\.kalinamall\.ru#github.com#g'
 apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
 apply_sed 's#remote add kalinamall#remote add origin#g'
 apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
 apply_sed 's#local name=kalinamall#local name=origin#g'
+apply_sed 's#всегда kalinamall#всегда origin#g'
 
 cat >"$WORK/.gitignore" <<'EOF'
 .DS_Store
@@ -79,26 +81,31 @@ MAIL_SMTP_SSL="0"
 EOF
 
 if [[ -f "$WORK/README.md" ]]; then
-  if [[ "$(uname -s)" == Darwin ]]; then
-    sed -i '' '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
-    sed -i '' '1s/^# ssh-monitor$/# ssh-monitor\
-\
-Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\
-\
-**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\
-\
-# ssh-monitor/' "$WORK/README.md"
-  else
-    sed -i '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
-    sed -i '1s/^# ssh-monitor$/# ssh-monitor\n\nBash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\n\n**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\n\n# ssh-monitor/' "$WORK/README.md"
-  fi
-
   python3 - "$WORK/README.md" <<'PY'
 import pathlib
 import sys
 
 path = pathlib.Path(sys.argv[1])
 text = path.read_text(encoding="utf-8")
+text = "".join(
+    line for line in text.splitlines(keepends=True)
+    if not line.startswith("> **Закрытый инстанс Gitea:**")
+)
+header = "# ssh-monitor\n\n**Версия:**"
+if header in text and "Bash monitor for" not in text.split("**Версия:**", 1)[0]:
+    text = text.replace(
+        header,
+        """# ssh-monitor
+
+Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram/SMTP alerts, optional IP ban (ipset/iptables), daily report, SAC integration.
+
+**Repository:** https://github.com/PTah/ssh-monitor
+
+# ssh-monitor
+
+**Версия:**""",
+        1,
+    )
 old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n"
 new = """## Topics (GitHub)