Package: put the guard user in adm and systemd-journal

Only the unit's SupplementaryGroups gave them, so 'sudo -u guard guard
test' and 'guard check' could read neither /var/log's files nor the
journal. systemd-sysusers (run on every install and upgrade) adds them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -28,3 +28,11 @@ All notable changes to Guard are documented here. The format follows
   the `adm` and `systemd-journal` groups, published with each release to
   the Gitea Debian registry (`stable`, or `testing` for a release
   candidate) along with tarballs for Linux amd64 and arm64.
+
+### Fixed
+
+- The package's `guard` user is now in the `adm` and `systemd-journal`
+  groups itself, as the documentation said, not only through its unit's
+  `SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
+  could read neither `/var/log`'s files (`permission denied`) nor the
+  journal. Upgrading adds the groups.

deploy/sysusers.d/guard.conf

@@ -1,3 +1,7 @@
 # Guard's system user (systemd-sysusers): it reads logs and talks to
-# Housecarl, nothing more.
+# Housecarl, nothing more. adm reads /var/log's files, systemd-journal
+# the journal, for the daemon (its unit adds them too) and for
+# 'sudo -u guard guard test'.
 u guard - "Guard log watcher" /var/lib/guard /usr/sbin/nologin
+m guard adm
+m guard systemd-journal