The rename_root_group_to_wheel Salt job isn't complete:
Eglide
$ grpck group root has an entry in /etc/gshadow, but its password field in /etc/group is not set to 'x' grpck: no changes
roles/shellserver/users/init.sls
rename_root_group_to_wheel: cmd.run: - name: sed -i 's/root:x:0:/wheel:x:0:/' /etc/group
This should rename too the entry in /etc/gshadow.