fix: enforce SAC git URL when updating ssh-monitor agents (0.20.8)

Pass REPO_URL/GIT_BRANCH from agent settings over SSH, preflight git remotes on stale hosts, and stop using GitHub origin on routers.

backend/tests/test_ssh_connect.py

@@ -232,7 +232,12 @@ def test_run_ssh_monitor_update_runs_script(monkeypatch):
                 stdout="ready\n",
             )
         if calls == 2:
-            assert kwargs["remote_cmd"] == "/opt/scripts/update_ssh_monitor.sh"
+            cmd = kwargs["remote_cmd"]
+            assert "git -C" in cmd
+            assert "kalinamall" in cmd
+            assert "REPO_URL=" in cmd
+            assert "git.kalinamall.ru" in cmd
+            assert "update_ssh_monitor.sh" in cmd
             assert kwargs.get("need_root") is True
             return ssh_connect.SshCommandResult(
                 ok=True,
@@ -251,7 +256,12 @@ def test_run_ssh_monitor_update_runs_script(monkeypatch):
 
     monkeypatch.setattr(ssh_connect, "run_ssh_command", fake_run)
 
-    result = run_ssh_monitor_update(target="ubabuba", user="root", password="pw")
+    result = run_ssh_monitor_update(
+        target="ubabuba",
+        user="root",
+        password="pw",
+        repo_url="https://git.kalinamall.ru/PapaTramp/ssh-monitor.git",
+    )
     assert result.ok is True
     assert result.agent_version == "2.1.0-SAC"
     assert calls == 3