docs(diag): say that a unix group name is deliberately kept, and pin it

[Behnam-RK]

Closes #69.

A redacted bundle ships control.group verbatim, in two entries:

// config.json
"control": { "enabled": true, "group": "vpnadmins" }

// doctor.json
"summary": "reachable (…, group \"vpnadmins\") — routine ops need no password."

#69 asked whether that is a leak. It is not, and this records the answer so it is not refiled.

A unix group is a property of the machine rather than of the person or the provider — the macOS default is admin, which names nobody. The control check exists to tell you which group to join, and "you are not in the profile-1 group" cannot do that. Redacting it would replace the answer and hide no identity, which is the failure docs/contribute/testing.md names in its own words:

a bundle that hides the diagnosis has thrown away the answer and hidden no identity

What changes

Nothing in the behaviour. Two things that make the decision durable:

• docs/usage/cli.md gains a paragraph beside the kinds list. The page already enumerates what is replaced, so a reader would reasonably assume a group name was covered; now it says it is kept, and why. The same paragraph names the other deliberate keep — dezhban's own file paths, from redact: control.sock is redacted as a hostname, so the control check's path reads as host-N #68 — because it is the same reasoning and both have now been questioned.
• TestAUnixGroupNameIsKeptInEveryEntryThatCarriesIt asserts both entries keep it, plus the socket path beside it, plus that the legend mints nothing for either.

Both entries, deliberately. Keeping it in only one would be worse than either answer: the same value reading as a token in one file and a name in the other is the "one identifier, two tokens" confusion internal/redact already works to avoid.

The other reading, and why it lost

A site-chosen group can carry an organisation (acme-vpn-ops). That is real, but it would need a key-aware case for config.json and a field carrier on the doctor check — the ADR-0016 shape — and it buys redaction of a string most people never customise, at the cost of the one check whose entire output is an instruction naming that string. If a site does use a revealing group name, --include-network is not the relevant lever; renaming the group is.

No CHANGELOG entry

Nothing user-visible changed — only what is written down about it.

🤖 Generated with Claude Code