fix: 把 SSH config.d Include 写到 ~/.ssh/config 第一行

Include 落在 Host/Match 之后会被当成该块的条件引入。ssh2 与 ff ssh
改为检测顶层 Include，缺失时插入文件首行并去掉块内重复项。

script/ssh2.sh

@@ -166,6 +166,21 @@ find_alias_file() {
     return 1
 }
 
+# Include 出现在 Host/Match 之后会被当成该块的条件引入，必须写在文件最前面。
+ssh_config_has_toplevel_include() {
+    awk '
+        tolower($1) == "host" || tolower($1) == "match" { saw_block = 1 }
+        tolower($1) == "include" {
+            for (i = 2; i <= NF; i++) {
+                if (tolower($i) ~ /(^|\/)config\.d\/\*/) {
+                    if (!saw_block) found_ok = 1
+                }
+            }
+        }
+        END { exit(found_ok ? 0 : 1) }
+    ' "$1"
+}
+
 ensure_config_include() {
     mkdir -p "$SSH_CONFIG_DIR"
     chmod 700 "$SSH_DIR" "$SSH_CONFIG_DIR"
@@ -177,17 +192,8 @@ ensure_config_include() {
         return
     fi
 
-    if awk '
-        tolower($1) == "include" {
-            for (i = 2; i <= NF; i++) {
-                if (tolower($i) ~ /(^|\/)config\.d\/\*/) {
-                    found = 1
-                }
-            }
-        }
-        END { exit(found ? 0 : 1) }
-    ' "$SSH_CONFIG"; then
-        chmod 600 "$SSH_CONFIG"
+    chmod 600 "$SSH_CONFIG"
+    if ssh_config_has_toplevel_include "$SSH_CONFIG"; then
         return
     fi
 
@@ -198,18 +204,26 @@ ensure_config_include() {
     cp -p "$SSH_CONFIG" "$backup"
 
     awk -v include_line="$INCLUDE_LINE" '
-        BEGIN {
-            print "# Managed SSH config fragments"
-            print include_line
-            print ""
+        function is_config_d_include() {
+            if (tolower($1) != "include") {
+                return 0
+            }
+            for (i = 2; i <= NF; i++) {
+                if (tolower($i) ~ /(^|\/)config\.d\/\*/) {
+                    return 1
+                }
+            }
+            return 0
         }
+        BEGIN { print include_line }
+        is_config_d_include() { next }
         { print }
     ' "$SSH_CONFIG" >"$tmp"
 
     cp "$tmp" "$SSH_CONFIG"
     rm -f "$tmp"
     chmod 600 "$SSH_CONFIG"
-    echo "已在 $SSH_CONFIG 中加入 config.d，并备份到 $backup"
+    echo "已在 $SSH_CONFIG 第一行加入 config.d Include，并备份到 $backup"
 }
 
 alias_name=""