feat(runner_account): support a differently named primary group

[jcardozo-eth]

Closes #25.

Changes

The runner_account struct gains an optional group key naming the account's primary group. It defaults to the account name, so existing hosts render and apply identically; set it when an externally provisioned account's primary group is named differently from the account (e.g. account ci-worker, primary group ci).

On Linux, a file (and a user account) has both an owner and a group. The module used the account name for both, so it worked only when the account's primary group shared the account's name. An externally created account whose group is named differently then failed on its first apply: the module tried to use the account name as the group, and no such group exists.

group separates the two. The account name still owns everything the module creates; the group value is used wherever the module sets a group: the group and primary group it gives the account when it manages the account, and the group of the runner configuration file, its directory, the .runner_system_id file, and the account's ~/.config/systemd/user folder.

The default is an absent key with the fallback resolved once in code, because the module data layer cannot express "same as the account name". Unset, the account name doubles as the group, which is correct by construction where the module creates the account.

Verification

• New tests thread a non-default group into every derived resource (extending the ownership-derivation context for the externally-owned case, plus the managed-account case for the group resource and the user's gid), and assert the default falls back to the account name. Both directions are mutation-checked: breaking the derivation fails exactly the custom-group cases while the fallback cases stay green.
• An unknown sibling key still fails the compile, and the key participates in the deep-merge lookup like the rest of the struct.
• Full gate green: 116 rspec examples, puppet-lint, metadata-json-lint, yamllint, and the REFERENCE.md docs check.