feat: release 2.1.8-SAC — security phase 1 and SAC-first update hardening

Updater applies chmod/chown on config, spool and state paths on every run.
SAC is the primary update path; optional cron uses the same behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>

ssh-monitor-watchdog

@@ -3,6 +3,11 @@ set -Eeuo pipefail
 IFS=$'\n\t'
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -f "$SCRIPT_DIR/ssh-monitor-perms.sh" ]; then
+	# shellcheck source=ssh-monitor-perms.sh
+	source "$SCRIPT_DIR/ssh-monitor-perms.sh"
+fi
 WATCHDOG_LOG_FILE="/var/log/ssh_monitor_watchdog.log"
 LAST_HEARTBEAT_FILE="/var/log/last_heartbeat.txt"
 WATCHDOG_MAX_HEARTBEAT_AGE=18000
@@ -75,9 +80,15 @@ notify_send() {
 
 load_config() {
 	if [ -f "$CONFIG_FILE" ]; then
+		local _strict_peek
+		_strict_peek="$(ssh_monitor_config_peek CONFIG_STRICT_PERMS "$CONFIG_FILE" "0")"
+		ssh_monitor_check_config_file_perms "$CONFIG_FILE" "$_strict_peek" || true
 		# shellcheck disable=SC1090
 		source "$CONFIG_FILE"
 	fi
+	if [ -n "${BACKUP_WEBHOOK_URL:-}" ]; then
+		write_log "WARN: BACKUP_WEBHOOK_URL deprecated (legacy fallback); будет удалён в 2.3.x"
+	fi
 }
 
 is_service_active() {