feat: publish a group the target does not have yet

[blaipr]

First of two for 0.28.0.

The problem

A source declares what a group means. Who is in it is frequently not that source's to know — Device42 settles membership on its next sync, and Ansible's group_by settles it at play time, putting a host into an existing group of the same name and picking up whatever vars it finds there.

The enricher skipped any group the target did not already have:

if !is_all && !target.groups.contains_key(name) { continue; }

For an inventory whose group membership comes from a different system, that is most groups. In our estate it meant 24 files of OS-specific variables — repositories_repos, packages, sshd, sssd, pamd — reached nothing at all, because oraclelinux_9 exists in the declaring source and not in the Device42 one.

The change, in two halves

Create the group rather than skipping it: vars, no hosts.

Render it too. A group with vars and no hosts was pruned as empty, so even a created group would have been thrown away between the enricher writing it and the endpoint answering — silently, with the enricher reporting success. Neither half is useful without the other.

The subtlety, found by an existing test

builtin_json_output_filters_via_query_params went red on the first attempt, and it was right to. Two empty groups are opposite cases:

• named hosts, a filter took them all → prune it. The filter's answer for that group is nothing, vars or no vars.
• never named any → keep it. It is a declaration for members settled elsewhere, and is useless if dropped.

So emptiness is read against whether the group ever listed a member, not just against the list being empty now. Pinned by an_emptied_group_is_pruned_but_one_that_never_had_hosts_is_kept.

Verified beforehand, not assumed

AWX imports a named group carrying variables and zero hosts, and attaches the vars — probed on a throwaway DEV inventory before any of this was written:

group: oraclelinux_9
  variables: {"probe_marker":"present","probe_repositories":["ol9-baseos"]}
  hosts: 0

Measured cost: 42 KB per target, against a pod sitting at 796 MiB of a 2 GiB limit. Group vars are stored once, not per member — that is the 0.26.0 design paying off.

Gates

cargo fmt --check clean, clippy --all-targets -- -D warnings clean, 587 tests. Three new, each red before the change; one existing test inverted, because it pinned the behaviour being replaced.

No host moves

An enricher still copies variables only. A shared group name cannot pull one source's hosts into another.