agent: add chrony supplementary group so it can read tracking.log (DAC)

The tracking.log read was still returning empty under enforcing with NO AVC —
the tell of a DAC (not SELinux) denial. Root cause: /var/log/chrony is mode
0750 chrony:chrony (others have no access), so the agent's DynamicUser (group
tss only) can't even traverse the directory to reach the 0644 tracking.log —
EACCES on open, which produces no audit record. Manager confirmed genuinely on
fleet-manager-1db3977 (chrony-capable), and uptime flowed while chrony didn't,
proving the agent was sending empty chrony (failed read), not a manager gap.
Earlier manual reads worked only as root (sudo) or because fleetadmin had been
usermod'd into chrony during the socket test (reverted on reboot — /etc/group
is on the volatile overlay).

Fix: SupplementaryGroups=tss chrony on the unit — the chrony group has r-x on
the 0750 dir so the agent can traverse it; the log file is world-readable. This
is the DAC half; the fleet_agent_chronylog SELinux module (02a6621) is the TE
half — BOTH are required (verified: group-only -> TE-denied; module-only ->
DAC-denied silently). Corrected the now-stale 'no group' code comment; recorded
the two-layer requirement in the .te and stig-deviations #16. Needs a
workstation image rebuild + reboot.

files/agent/snapshot.go

@@ -314,10 +314,12 @@ const chronyLogPath = "/var/log/chrony/tracking.log"
 // We read a FILE rather than query chronyd's command socket by design: that unix
 // socket is owner-write-only (0755) so the hardened non-root agent (DynamicUser,
 // not the chrony user) can't connect, and STIG closes the UDP command port
-// (cmdport 0). `log tracking` writes the same fields to a world-readable log the
-// agent can read under ProtectSystem=strict — no port, no socket, no group, no
-// SELinux domain transition. Tradeoff: the offset is as fresh as chrony's last
-// update (up to ~maxpoll old), which is fine for a slow-moving health metric.
+// (cmdport 0). `log tracking` writes the same fields to this log and no domain
+// transition is needed. Two access layers must both be satisfied (the unit does):
+// the chrony group to TRAVERSE /var/log/chrony (0750) at the DAC layer, and the
+// fleet_agent_chronylog SELinux module to read the chronyd_var_log_t label under
+// enforcing. Tradeoff: the offset is as fresh as chrony's last update (up to
+// ~maxpoll old), which is fine for a slow-moving health metric.
 func chronyTracking() chrony {
 	b, err := os.ReadFile(chronyLogPath)
 	if err != nil {