commit 368af84ff5d29355d67a52a76eb117c9f12ffdea
Author: Stefano Balzarotti <stefano.balzarotti@orbintsoft.net>
Date: Tue Jul 14 21:08:56 2026 +0200

fix(acct-group): pin 1password/onepassword-cli GIDs to >= 1000

ACCT_GROUP_ID=-1 lets the acct-group eclass auto-allocate into Gentoo's
system range (996/997 here). 1Password's own Linux binaries silently
reject a setgid helper whose group id is below 1000 (undocumented
upstream behaviour; other distros hitting the same default system-range
allocation report the identical failure): 1Password-BrowserSupport
aborted on startup with a binary-permission-verification error, and op
CLI's app integration reset every connection as a result.

Fixed ids (1006, 1007) move both groups into the human-UID range,
matching what the officially packaged .deb/.rpm builds use.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

commit f74a449ba05ed40f18cb584dd4b289adaa3edf4e
Author: Stefano Balzarotti <stefano.balzarotti@orbintsoft.net>
Date: Fri Jul 10 07:23:55 2026 +0200

feat(acct-group): add 1password and onepassword-cli groups

1Password's browser-support helper and the `op` CLI are each setgid to a
dedicated group, which the desktop app checks to authenticate its caller.
Neither group exists in ::gentoo, so the overlay must ship them to stay
self-contained under `masters = gentoo`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>