Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0251, issue 247)

A module puts the operator's account in a group by declaring the account with that group alone.
The node-engine now records each group it added, takes back only those when nothing declared still
asks for them, refuses a group the machine lacks before usermod runs, and states each such account
as its module's resource of kind account: relogin needed while the running session lacks the group.

internal/system/alpine.go

@@ -173,3 +173,12 @@ func (alpine) AddUserToGroup(ctx context.Context, run Runner, name, group string
 	}
 	return nil
 }
+
+// RemoveUserFromGroup uses busybox delgroup, which given an account and a group takes the account out of
+// that group only (novox/hq ADR 0251).
+func (alpine) RemoveUserFromGroup(ctx context.Context, run Runner, name, group string) error {
+	if _, err := run(ctx, "delgroup", name, group); err != nil {
+		return fmt.Errorf("cannot take %q out of the group %q: %w", name, group, err)
+	}
+	return nil
+}