fix: enforce SAC git URL when updating ssh-monitor agents (0.20.8)

Pass REPO_URL/GIT_BRANCH from agent settings over SSH, preflight git remotes on stale hosts, and stop using GitHub origin on routers.

backend/app/api/v1/hosts.py

@@ -415,10 +415,11 @@ def update_host_agent_via_ssh(
 
     agent_cfg = get_effective_agent_update_config(db)
     repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
+    branch = (agent_cfg.git_branch or "main").strip() or "main"
     response = _run_ssh_action_on_host(
         host,
         cfg,
-        action=partial(run_ssh_monitor_update, repo_url=repo_url),
+        action=partial(run_ssh_monitor_update, repo_url=repo_url, git_branch=branch),
     )
     _set_ssh_admin_status(host, response.ok)
     if response.ok and response.product_version: