fix: suppress sudo Telegram during SAC agent update (2.2.3-SAC)

Whitelist SAC maintenance commands in ssh-monitor-perms and monitor_sudo; pre-commit uses working python on Windows.

update_ssh_monitor.sh

@@ -1570,10 +1570,6 @@ update_script() {
 
     load_git_verify_settings
     load_ssh_monitor_perms_lib || true
-    if declare -F ssh_monitor_update_mark_begin >/dev/null 2>&1; then
-        ssh_monitor_update_mark_begin
-        log_action "agent-update: state file установлен (подавление lifecycle/watchdog)"
-    fi
     log_action "Старт обновления (deploy=$DEPLOY_MODE, debug=$DEBUG, git_ref=${GIT_REF:-$GIT_BRANCH})"
     debug_step "Запуск функции обновления скрипта"
 
@@ -1757,6 +1753,11 @@ parse_command_line "$@"
 deploy_require_root
 require_repo_url
 
+load_ssh_monitor_perms_lib || true
+if declare -F ssh_monitor_update_mark_begin >/dev/null 2>&1; then
+    ssh_monitor_update_mark_begin
+fi
+
 if [ "$DEPLOY_MODE" -eq 1 ]; then
     printf '\n=== ssh-monitor: первичная установка (--deploy) ===\n'
     say_step "Репозиторий и файлы"