Release PR #81's changelog is missing two entries — add before merging 3.0.0

**Blocks merging #81** (`chore(main): release 3.0.0`). PyPI uploads are irreversible, so the changelog needs to be right *before* the merge tags `v3.0.0`.

release-please generates `CHANGELOG.md` from commit trailers, and two things are missing because no commit declared them.

## 1. Undeclared breaking change: `ProviderDescriptor.deprecated_options` removal

#95 removed `deprecated_options` from `ProviderDescriptor` and deleted the `CREATE_YES_DEPRECATION` / `DeprecatedOption` symbols from `core/provider_registry.py` (verified: zero occurrences remain in `src/remo_cli/`). An out-of-tree provider descriptor passing that field now fails with:

```
TypeError: ProviderDescriptor.__init__() got an unexpected keyword argument 'deprecated_options'
```

The `BREAKING CHANGE:` trailer on that commit mentions only the `--yes` CLI flag. `docs/providers.md` was corrected in #95, but the changelog entry was not. Originally raised in #97.

## 2. Behavior change: `remo shell` no longer backfills managed tags

#105 stops `remo shell`'s tools-update path from tagging instances (it was reaching the hypervisor over SSH for a write the user never asked for). An instance created before tagging existed now stays unmarked until `remo sync` or an explicit `remo update` runs; previously any `remo shell` would have quietly fixed it.

Not breaking — `sync` already names unmarked instances and prints the remedy, and a one-time post-migration notice points at the right command — but users should not have to discover it.

## Timing

Do this **immediately before** merging, not in advance: release-please regenerates `CHANGELOG.md` every time it refreshes the PR, so a hand-edit made early gets clobbered.

The durable alternative is amending the offending commit messages on `main` so release-please derives both entries itself — more invasive, but it survives every refresh.

## Also confirm before tagging

- `RELEASE_PLEASE_TOKEN` is set, or the `v3.0.0` tag will not trigger the publish.
- #52 (pre-release detection substring-matching) is **not** in the path for this tag — already verified: `v3.0.0` resolves to `is_prerelease=false` and `PREV_TAG=v2.2.0`, both correct. It stays open as latent.

## Validation gate already run on #81's head

`uv run pytest -q` 1809 passed / 17 skipped; `uv build` → `remo_cli-3.0.0-py3-none-any.whl`; `remo --version` → `remo 3.0.0`; `create --yes` absent on all four providers, `destroy --yes` still present; 22 Ansible playbooks packaged. Note the branch was 2 commits behind `main` at the time (docs/CI-only, no effect on the wheel).

Related: #97 (semver decision, closed — 3.0.0 confirmed), #105, #81.

Start with release PR #81 and its generated CHANGELOG.md, then inspect the release-please configuration and the commits for #95 and #105. Confirm the two missing entries and update the changelog immediately before merging, after release-please's final refresh. Done means the changelog accurately covers both changes and the existing validation gate still passes.

Written by the indexing model from the issue text.