The workaround described above works. Changed it to following line and added few more system-users spotted in the AAA daemon logs:

Can you check if changing this line https://github.com/vyos/vyos-1x/blob/current/data/templates/login/tacplus_nss.conf.j2#L33 and adding those user helps?
This file can be changed locally in the router: /usr/share/vyos/templates/login/tacplus_nss.conf.j2
Change line:

exclude_users=root,telegraf,radvd,strongswan,tftp,conservr,frr,ocserv,pdns,_chrony,_lldpd,sshd,openvpn,radius_user,radius_priv_user,*{{ ',' + user | join(',') if user is vyos_defined }}

And change it to something like:

I think this will not be required

Also probably related:

I would expect the line of CLI being used to be in any of these files?

I think, a new command is required for this show integrity or similar. Also a brief status in MOTD and show version.

Do you want some CLI for it? Or just user util?