Upon further testing, you are correct. The roles field is not auto-maintained by adding/removing groups in the related list. Similarly, the related list is not auto-maintained by adding/removing fields from the roles list field. I was under the impression that it was.
It wouldn't take much to write a business rule on sys_user_has_role table to keep the roles field updated and then make your report fairly simple as you originally requested.
Any time a record is added or deleted, you know the user, so update the record's field with which ever roles you find for that user in the table (accounting for uniqueness.) Don't forget, list fields are comma separated sys_ids so you'll need the sys_id of the role, which is easy enough since sys_user_has_role.role is a reference field and not a string.
