chore(main): release 3.0.0

[github-actions]

🤖 I have created a release beep boop

3.0.0 (2026-07-27)

⚠ BREAKING CHANGES

• removed the --yes/-y flag on remo <provider> create for all four providers. It never had any effect — creation has no confirmation prompt to skip. Remove it from scripts; no replacement is needed. --yes continues to work on destroy, sync, snapshot restore, snapshot delete, and remo remove.

Features

• /release skill + dev-build workflow (cross-machine RC/dev wheels, no PyPI) (#79) (bb0dc89)
• add: provider-neutral remo add/remo remove for SSH-reachable hosts (014) (#77) (14b06dd)
• ci: use a GitHub App token for release-please (fallback to PAT/GITHUB_TOKEN) (#83) (5eb6848)
• incus/proxmox: tag managed containers and filter sync by default (#76) (bd45b0c)
• providers: formal provider abstraction — descriptor + Protocol + CLI factory (018) (#90) (11196dc), closes #87
• registry: versioned structured host registry (registry v2) (#85) (2a3d92e)
• sync: shared reconcile engine across all four providers (016) (#88) (fb58da3)
• web: schema-derived frontend types + drift checks (020) (#99) (f13d667)
• web: unify push flow, offline drift, revocation & flap detection (017) (#89) (f9863c6)

Bug Fixes

• ansible: retry Docker apt refresh + install to survive repo-index flakiness (#91) (d0794f2)
• ci: fall back to GITHUB_TOKEN in release-please so it works without the PAT (#80) (212aa6d)
• ci: read registry.json (v2) in aws smoke SSM step, not legacy known_hosts (#92) (2c0c283)
• ci: scope release-please to pyproject.toml only (leave init.py sentinel) (#82) (00e750a)
• skill: repair three broken commands in the release skill (#104) (3f5aef2)

Miscellaneous Chores

• dependency, dead-code & documentation hygiene pass (019) (#95) (866f413)

---

This PR was generated with Release Please. See documentation.

[pofallon]

Blocked on a decision — see #97.

This PR proposes 3.0.0 because 866f413 (#95) carries a BREAKING CHANGE: trailer for removing the --yes flag from remo <provider> create. That flag never had any effect, so the major bump may not be the intended step. #97 lays out the trade-off.

Whichever version ships, the changelog should also record a second break that the trailer does not mention: #95 removed deprecated_options from ProviderDescriptor, which breaks out-of-tree provider descriptors.

[pofallon]

Pre-merge checklist — 3.0.0 confirmed, do not merge yet

Semver decision made and recorded in #97 (now closed): 3.0.0 stands. Merging is gated on local testing of the artifact first.

✅ Validation gate passed on this branch's head

Run per the release skill's Step V — the identical artifact uv build would publish:

Step	Result
uv run pytest -q	1809 passed, 17 skipped
uv build	remo_cli-3.0.0-py3-none-any.whl + .tar.gz
remo --version in a clean venv	remo 3.0.0 — matches
remo --help	loads, all 10 commands present
create --yes on incus/hetzner/aws/proxmox	absent on all four
destroy --yes	still present — break correctly scoped
Ansible playbooks in wheel	22, packaged

✅ #52 cleared for this tag

release.yml's prerelease detection resolves v3.0.0 → is_prerelease=false and PREV_TAG=v2.2.0, both correct. No stable tag in the repo contains rc/beta/alpha/dev as a substring. #52 stays open as latent, but does not block this release.

⬜ Blocking: the changelog is missing a second breaking change

The BREAKING CHANGE: trailer only mentions the CLI flag. #95 also removed deprecated_options from ProviderDescriptor and deleted the CREATE_YES_DEPRECATION / DeprecatedOption symbols from core/provider_registry.py (verified: zero occurrences remain in src/remo_cli/). An out-of-tree provider descriptor passing that field now fails with:

TypeError: ProviderDescriptor.__init__() got an unexpected keyword argument 'deprecated_options'

This needs adding to the changelog before merge.

Timing note: do this immediately before merging, not now. release-please regenerates CHANGELOG.md whenever it refreshes this PR, and main has already moved past this branch (currently 2 commits ahead — a51c6f3, 3f5aef2, both docs/CI-only and irrelevant to the wheel). A hand-edit made now will be clobbered on the next refresh.

⬜ Blocking: local testing by @paulofallon

Install the exact head of this branch on any machine:

uv tool install --force \
  "git+https://github.com/get2knowio/remo.git@release-please--branches--main--components--remo-cli"
remo --version   # expect: remo 3.0.0

Alternatively, a CI-built wheel that can never reach PyPI (carries a +g<sha> local segment):

gh workflow run dev-build.yml -f version=3.0.0

Reminder

Merging this PR tags v3.0.0 and publishes to PyPI + GHCR. PyPI uploads are irreversible. Confirm RELEASE_PLEASE_TOKEN is set before merging — without it the tag never triggers the publish.

[pofallon]

Two follow-ups now tracked in #108 (changelog additions needed before this merges) — the undeclared ProviderDescriptor.deprecated_options break from #95, and the remo shell tagging behavior change from #105.

Also opened #106 and #107 for the proxmox node_user defects found while testing this build. Neither blocks the release.