TIL that the /lib/systemd/systemd --user process for a user with linger enabled does not automatically pick up group membership changes. Also, there does not appear to be a clean way to get it to pick up the changes, e.g. systemctl --user reexec doesn’t work. Resorted to killing it and relogging in.