Compose an account given only groups where its module wrote it (hq ADR 0251, issue 247)

Composed first, an account a module puts in its daemon's group was put in a group the package
had not made yet, and only the next apply healed it. An account that sets a shell or home still
goes first (issue 213).

internal/catalogue/declaration.go

@@ -2396,9 +2396,15 @@ func withRestartOn(have any, add []string) []any {
 
 // accountsFirst splits a module's resources into its accounts and everything else, each in the order
 // written.
+//
+// **An account declared only to be put in groups keeps its written place** (novox/hq ADR 0251). It is not
+// the module's own account — that one says how it logs in or where it lives — but one the module needs in
+// a group: the operator's, in the group of a daemon the module installs. The group is made by the package
+// that installs the daemon, so put first, the account was put in a group the machine did not have yet, and
+// only the next apply healed it. Written after its packages, it is applied after them.
 func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any) {
 	for _, r := range resources {
-		if fmt.Sprint(r["type"]) == "user" {
+		if fmt.Sprint(r["type"]) == "user" && !onlyGroups(r) {
 			accounts = append(accounts, r)
 			continue
 		}
@@ -2407,6 +2413,17 @@ func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any)
 	return accounts, rest
 }
 
+// onlyGroups is a user resource that names groups and nothing else of the account: no shell, home or
+// lingering.
+func onlyGroups(r map[string]any) bool {
+	for _, field := range []string{"shell", "home", "linger"} {
+		if v, ok := r[field]; ok && v != nil && v != "" {
+			return false
+		}
+	}
+	return len(stringsIn(r["groups"])) > 0
+}
+
 // generatedHere is what each computed module's generator answers for this machine, by module —
 // absent for a module whose machine is not yet part of what it generates — held to the rule every
 // module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq