SSH `ControlMaster` breaks group update in provision section

For a lima-vm config similar to the following one
```
provision:
- mode: system
script: |
#!/bin/bash
set -eux -o pipefail
command -v docker >/dev/null 2>&1 && exit 0
export DEBIAN_FRONTEND=noninteractive
curl -fsSL https://get.docker.com | sh
- mode: user
script: |
#!/bin/bash
set -eux -o pipefail
sudo usermod -G docker -a $(whoami)
```

The usage in ssh ops `-o ControlMaster=auto` will leads the ssh connection is being re-used, which is created before the provision script is executed (where the user group is updated)

Expected behaviour: the group update via provision section is effective

Actual behaviour: the group update is effective, unless a new ssh connection is created, OR VM is rebooted.