AWS sync: probe's default access_mode="ssm" can overwrite a differing existing entry via merge_entry

[pofallon]

Found during the xhigh code review of 016-sync-reconcile. Reported but intentionally not auto-fixed, because the obvious mechanical fix has a downside that needs a design decision.

Problem

providers/aws.py::_probe builds each discovered entry with:

access_mode=tags.get("remo_access_mode", "ssm"),

so the probe's access_mode is never empty — it is "ssm" unless an instance carries a remo_access_mode tag. core/reconcile.py::merge_entry then prefers the discovered value over the existing one:

access_mode=discovered.access_mode or existing.access_mode,

Because discovered.access_mode is always truthy ("ssm"), an existing registry entry whose access_mode differs (e.g. a hand-edited or legacy "ssh" entry) is silently rewritten to "ssm" on every remo aws sync, and shows up as an updated line each run even when nothing else changed.

Impact

• Low / edge: AWS entries are ssm in the normal create path, so this only bites hand-edited, imported, or legacy entries.
• Symptoms: a persistent spurious ~ updated for such an entry on every sync, and a connection-mode flip that the user did not ask for.

Why it wasn't auto-fixed

The tempting fix — access_mode=tags.get("remo_access_mode", "") so merge_entry preserves the existing value — would leave newly adopted instances (no prior registry entry, no remo_access_mode tag) with an empty access_mode, which would break remo shell for them. So the default is load-bearing for the add path and can't simply be blanked.

Options to consider

1. Split the two paths: keep "ssm" for added hosts, but pass "" (or omit) for the merge comparison so an existing non-default mode survives.
2. Only include access_mode in the merge when the instance actually carries a remo_access_mode tag.
3. Decide that ssm is authoritative for AWS and document that hand-set modes are not preserved (accept current behavior, close as wontfix).

Repro sketch

1. Registry has an aws entry remo-x with access_mode="ssh", region=<r>.
2. The live instance in <r> has no remo_access_mode tag.
3. remo aws sync --region <r> → entry is reported as updated and its access_mode becomes ssm.

Source refs: src/remo_cli/providers/aws.py (_probe, ~line 807) and src/remo_cli/core/reconcile.py (merge_entry).