feat: release 2.2.1-SAC — phase 2 manifest verify and quiet SAC updates

Pinned GIT_REF/verify, release manifest, no blind reset --hard; suppress
lifecycle and watchdog Telegram during updater; healthcheck via json.dumps.

ssh-monitor-watchdog

@@ -142,6 +142,11 @@ main() {
 	mkdir -p "$(dirname "$WATCHDOG_LOG_FILE")"
 	touch "$WATCHDOG_LOG_FILE"
 
+	if ssh_monitor_update_in_progress 2>/dev/null; then
+		write_log "Watchdog: пропуск — идёт agent-update (state file)"
+		exit 0
+	fi
+
 	local reason=""
 	if ! is_service_active; then
 		reason="systemd reported inactive service"