deploy: simplify group management

Primary group is always 'deploy', specify only additional groups in params.