fix: never chmod 700 system dirs like /var/log (2.3.3-SAC)

Hardening state files under /var/log was applying chmod 700 to the parent
directory, which broke syslog/logrotate and other services after agent update.

contrib/test-system-dir-hardening.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Smoke-test: hardening must not chmod system dirs like /var/log.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=/dev/null
+source "$ROOT/ssh-monitor-perms.sh"
+
+fail=0
+assert_true() {
+	if "$@"; then
+		return 0
+	fi
+	printf 'FAIL: expected true: %s\n' "$*" >&2
+	fail=1
+}
+assert_false() {
+	if "$@"; then
+		printf 'FAIL: expected false: %s\n' "$*" >&2
+		fail=1
+		return 0
+	fi
+	return 0
+}
+
+assert_true ssh_monitor_is_system_dir /var/log
+assert_true ssh_monitor_is_system_dir /var/log/
+assert_true ssh_monitor_is_system_dir /etc
+assert_true ssh_monitor_is_system_dir /var
+assert_true ssh_monitor_is_system_dir /
+assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor
+assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor/sac-spool
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+# Private dir still gets 700 (на настоящем Linux; в Git Bash/Windows mode может не примениться)
+ssh_monitor_secure_dir "$tmpdir/owned"
+mode="$(stat -c '%a' "$tmpdir/owned" 2>/dev/null || stat -f '%OLp' "$tmpdir/owned" 2>/dev/null || echo "")"
+if [ -n "$mode" ] && [ "$mode" != "700" ] && [ "$mode" != "0700" ]; then
+	if [[ "$(uname -s 2>/dev/null || true)" == Linux ]]; then
+		printf 'FAIL: owned dir mode=%s (want 700)\n' "$mode" >&2
+		fail=1
+	else
+		printf 'WARN: skip mode assert on non-Linux (mode=%s)\n' "$mode" >&2
+	fi
+fi
+
+if [ "$fail" -ne 0 ]; then
+	exit 1
+fi
+printf 'OK: system-dir hardening guards\n'