Transient supplementary groups

Trap: empty SupplementaryGroups= looks like it clears supplementary groups, but systemd still loads memberships from the byk account database. Fix: remove the misleading declaration and document that the accepted direct PTY inherits byk groups; use a dedicated account or verified group-clearing launcher only if adopting a stronger trust model. Never claim group isolation without /proc/<pid>/status evidence.