Judge a granted group by number, grant nothing a group cannot write, and keep the look bounded (hq ADR 0312, issue 537 review)

The engine is built without cgo, so a check by name missed a root group a name
service holds or one number carrying another name: the root groups are resolved
to numbers (now with kmem and shadow) and a number named nothing is refused for
containers too. A group without write is granted nothing (§2). The look reads
each path off the lock within five seconds, so a dead network mount cannot stop
every health statement. A grant's account may not start with a dash. A group a
record leaves for another asker is handed to it, so it is still taken back when
the last asker goes (§5). The scheduler skips paths issue 339's guard refuses.

internal/declaration/declaration.go

@@ -522,9 +522,11 @@ func (a *Access) validate(where string, _ bool) []string {
 				problems = append(problems, where+": a grant names a container with no id")
 			}
 		}
-		if a.Grant.Account != "" && strings.ContainsAny(a.Grant.Account, " :/\t\n") {
-			problems = append(problems, where+": a grant's account is an account's name, and "+
-				a.Grant.Account+" is not one")
+		if a.Grant.Account != "" && !accountName.MatchString(a.Grant.Account) {
+			// Handed to id, usermod and gpasswd as an argument: a name starting with a dash would be read as an
+			// option by each of them.
+			problems = append(problems, fmt.Sprintf("%s: a grant's account is an account's name — letters, digits, "+
+				"dots, underscores and dashes, not starting with a dash — and %q is not one", where, a.Grant.Account))
 		}
 	}
 	return problems
@@ -1778,6 +1780,10 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
+// accountName is what a grant's account may be: the portable account name the user tools take, optionally ending
+// in `$`, never starting with a dash.
+var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
+
 // checkGrants judges each access's grant against the whole declaration (novox/hq ADR 0312): a container it
 // names is a container of this declaration, as a maintenance window's are. A grant to a container the machine
 // is not told about would be a group given to nothing, said as granted.