feat: release 2.2.1-SAC — phase 2 manifest verify and quiet SAC updates

Pinned GIT_REF/verify, release manifest, no blind reset --hard; suppress
lifecycle and watchdog Telegram during updater; healthcheck via json.dumps.

Makefile

@@ -1,10 +1,13 @@
 # Версия берётся из ssh-monitor (SSH_MONITOR_VERSION).
-.PHONY: dist clean-dist
+.PHONY: dist clean-dist manifest
 VERSION := $(shell sed -n 's/^SSH_MONITOR_VERSION="\(.*\)".*/\1/p' ssh-monitor | head -n1)
 DIST := ssh-monitor-$(VERSION).tar.gz
 
 dist: $(DIST)
 
+manifest:
+	./scripts/build-release-manifest.sh
+
 $(DIST): ssh-monitor
 	git archive --format=tar.gz --prefix=ssh-monitor-$(VERSION)/ -o $(DIST) HEAD