This is much simpler than ensuring proper group set in every qubes tool.
This way it will be done much earlier, so qubes-db can be started before qubes-core.service - which will solve startup dependency loop problem.