Judge a granted group by number, grant nothing a group cannot write, and keep the look bounded (hq ADR 0312, issue 537 review)

The engine is built without cgo, so a check by name missed a root group a name
service holds or one number carrying another name: the root groups are resolved
to numbers (now with kmem and shadow) and a number named nothing is refused for
containers too. A group without write is granted nothing (§2). The look reads
each path off the lock within five seconds, so a dead network mount cannot stop
every health statement. A grant's account may not start with a dash. A group a
record leaves for another asker is handed to it, so it is still taken back when
the last asker goes (§5). The scheduler skips paths issue 339's guard refuses.

internal/apply/groups.go

@@ -63,7 +63,7 @@ func (w Wanted) othersAsk(account, group, except string) []string {
 // applyGroups makes the account be in every group the resource declares, and takes it out of every group
 // this resource put it in and no longer asks for. What the mesh put the account in is recorded on out.
 func applyGroups(ctx context.Context, sys system.System, r *declaration.User, run Runner,
-	previous store.Applied, wanted Wanted, out *Outcome) error {
+	previous store.Applied, wanted Wanted, handed Handed, out *Outcome) error {
 	// What this resource put the account in before, for this account only: a declaration that renamed its
 	// user says nothing about the new one's groups.
 	var added []string
@@ -83,6 +83,10 @@ func applyGroups(ctx context.Context, sys system.System, r *declaration.User, ru
 	var put []string
 	for _, want := range r.Groups {
 		if already[want] {
+			// A record that went handed it here: the mesh's, and this resource's to take back (novox/hq ADR 0312 §5).
+			if handed.has(r.Name, want) && !contains(added, want) {
+				added = append(added, want)
+			}
 			continue
 		}
 		exists, err := system.GroupExists(ctx, system.Runner(run), want)
@@ -139,7 +143,11 @@ func applyGroups(ctx context.Context, sys system.System, r *declaration.User, ru
 // giveGroupsBack is removeUser's groups: every group the mesh put the account in, taken back unless
 // another declared resource still asks for it. Never fatal, for the shell's reason: a removal that failed
 // would stay recorded and fail the same way on every apply after. Empty when there was nothing to say.
-func giveGroupsBack(ctx context.Context, sys system.System, a store.Applied, run Runner, wanted Wanted) (bool, string) {
+//
+// A group left because another declared resource still asks for it is handed to that resource (handed), which
+// records it as the mesh's, so it is taken back once nobody asks (novox/hq ADR 0312 §5).
+func giveGroupsBack(ctx context.Context, sys system.System, a store.Applied, run Runner, wanted Wanted,
+	handed Handed) (bool, string) {
 	if len(a.Groups) == 0 {
 		return false, ""
 	}
@@ -157,6 +165,7 @@ func giveGroupsBack(ctx context.Context, sys system.System, a store.Applied, run
 		}
 		if others := wanted.othersAsk(a.Target, g, a.ID); len(others) > 0 {
 			said = append(said, fmt.Sprintf("left in %s, which %s still asks for", g, strings.Join(others, ", ")))
+			handed.hand(a.Target, g)
 			continue
 		}
 		gone, why := leaveGroup(ctx, sys, a.Target, g, run)