Where are supplemental groups coming from in /proc/pid/status, are they always inherited from a shell? In /proc/pid/status we can see all the supplemental groups for the pid (My understanding is this is assuming it was forked from an interactive shell or the process did getgroups(2)) I want to know how these groups are being provided to processes. Are they generally all inherited from the parent shell, and we should just assume the parent shell did getgroups at some point (or inherited the value from a login shell which did getgroups)?

Your understanding is correct. Groups are always inherited from the parent process (init starts with no supplementary groups). The only way this is ever changed is by setgroups. This is done by su, sshd, or whatever privileged process performed the login for the user. By the time the user's shell runs, the groups are already set.