GitLab

Also add a document describing what things need to be "regularly" changed.
Further similar things should be added there for tracking and maintainership purposes.

Thus "Systems" is redundant

This way, the above paragraph reads like an enumeration, followed by a
deeper dive for the platform without anything built-in.

The reality of the situation is kind of complicated.
Canonical su(1) is based on PAM, and PAM can require whatever it wants.
The default however, does not require a special group.
Further, alpine uses busybox by default, which also has no such
requirements.

setup-disk should handle it, and I couldn't think of a good way to
mention it

MAINT -> COMBAK

And link RFC 1178

New users won't know to make a new user.
Old users will know that all of this needs to be done as root.
As such, no one is served by this extra notice.

While more appropriate, it feels weird.

This isn't broken, it's a future task.