Ok, apparently group changes are fine as `type/user.rb` [handles this](https://github.com/puppetlabs/puppet/blob/3.1.1/lib/puppet/type/user.rb#L146) by calling `Puppet::Util.gid` during sync.