feat(incus/proxmox): tag managed containers and filter sync by default

[pofallon]

What & why

remo's four providers split into two mental models for sync: AWS/Hetzner
filter on a provider-native marker (tag:remo=true / label_selector=remo) and
only touch remo-created instances, while Incus/Proxmox marked nothing and
imported every container on the host. This closes that gap.

Incus/Proxmox containers remo creates are now marked at provision time, and
sync filters on that marker by default, with an explicit --all opt-out.

Implements spec 013-managed-instance-tags (FR-001…FR-013, SC-001…SC-006).

Behavior

• create / update apply a fixed, provider-native marker host-side
  (Incus user.remo=true config key; Proxmox remo guest tag). Idempotent;
  Proxmox preserves existing tags via a tag-set union. A marking failure warns
  but never fails the command (FR-005).
• sync (default) registers only marked containers and names any skipped
  unmarked ones with both remedies (--all, update <name>).
• sync --all restores the pre-feature "adopt everything" behavior and flags
  the adopted-unmarked count.
• sync stays read-only; one bulk marker query per provider (FR-013).
• No change to AWS/Hetzner, the registry line format, or the connect path.

Design note

The marker is applied host-side in the Python provider layer, not Ansible,
because update's dev-tools playbook connects to the container's IP, not the
hypervisor host — only the provider layer holds a host/node SSH context at both
create and update time.

Follow-up

Proxmox host access remains root SSH (pct/conf parsing). Migrating that to the
Proxmox REST API is tracked in #75 — that would also expose tags as structured
data, retiring the conf-parsing this PR hardened.

Tests

New unit suites for both providers (marker apply/read, create/update wiring,
filtered sync, --all, FR-010 read-only, FR-013 bounded queries, and a
regression test for snapshot-section tag shadowing). Full suite green locally
(1125 passed); ruff + mypy clean.

🤖 Generated with Claude Code