feat: deploy UseSAC fallback by default on install and script upgrade

Co-authored-by: Cursor <cursoragent@cursor.com>

ssh-monitor.conf.example

@@ -28,7 +28,7 @@ NOTIFY_ORDER=""
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. docs в security-alert-center (agent-integration.md)
-UseSAC="dual"
+UseSAC="fallback"
 # Допустимо и корень хоста (ingest всё равно пойдёт на /api/v1/events):
 SAC_URL="https://sac.kalinamall.ru"
 SAC_API_KEY="sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8"

update_ssh_monitor.sh

@@ -137,7 +137,7 @@ ensure_ssh_monitor_config_from_example() {
         cp "$CONFIG_FILE" "${CONFIG_FILE}.bak.$(date +%Y%m%d_%H%M%S)" 2>/dev/null || true
         log_message "INFO" "Upgrading config without SAC: backup created, applying ssh-monitor.conf.example from git."
         if [ "$DEPLOY_MODE" -eq 1 ]; then
-            say_info "Апгрейд без SAC: резервная копия, применяем example (Telegram + dual)."
+            say_info "Апгрейд без SAC: резервная копия, применяем example (Telegram + fallback)."
         fi
     else
         log_message "INFO" "Creating $CONFIG_FILE from ssh-monitor.conf.example"
@@ -155,6 +155,25 @@ ensure_ssh_monitor_config_from_example() {
     return 0
 }
 
+sync_use_sac_fallback_mode() {
+    local file="$CONFIG_FILE"
+    [ -f "$file" ] || return 1
+    if grep -qE '^[[:space:]]*UseSAC=[[:space:]]*["'"'"']?fallback["'"'"']?[[:space:]]*(#.*)?$' "$file" 2>/dev/null; then
+        return 1
+    fi
+    if ! grep -qE '^[[:space:]]*UseSAC=' "$file" 2>/dev/null; then
+        return 1
+    fi
+    cp "$file" "${file}.bak.$(date +%Y%m%d_%H%M%S)" 2>/dev/null || true
+    sed -i -E 's/^[[:space:]]*UseSAC=.*/UseSAC="fallback"/' "$file"
+    log_message "INFO" "Config $file: UseSAC set to fallback (deploy policy on script upgrade)."
+    if [ "$DEPLOY_MODE" -eq 1 ]; then
+        say_info "UseSAC=fallback (рабочий режим SAC + локальный fallback)."
+    fi
+    CONFIG_CHANGED=1
+    return 0
+}
+
 parse_command_line() {
     DEPLOY_MODE=0
     while [ $# -gt 0 ]; do
@@ -945,7 +964,13 @@ update_script() {
 
     if [ "$DEPLOY_MODE" -eq 1 ]; then
         script_changed=1
-    elif [ "$script_changed" -eq 1 ] || [ "${SAC_CLIENT_CHANGED:-0}" -eq 1 ] || [ "${CONFIG_CHANGED:-0}" -eq 1 ]; then
+    fi
+
+    if [ "$script_changed" -eq 1 ]; then
+        sync_use_sac_fallback_mode || true
+    fi
+
+    if [ "$script_changed" -eq 1 ] || [ "${SAC_CLIENT_CHANGED:-0}" -eq 1 ] || [ "${CONFIG_CHANGED:-0}" -eq 1 ]; then
         restart_ssh_monitor_service
     else
         log_action "перезапуск сервиса не нужен (ни один файл не изменился)"