(besides fingerprinting which is not considered here)
I don't think it's very helpful to distinguish fingerprinting from tracking.
Is it correct that (third-party) cookies and ETags provide the only way to track users across domains
All tracking methods work by assigning a unique ID to you and making sure that you (or your browser) send that ID back when you visit a domain.
For example, you could also use the other cache control HTTP headers to send unique ids, for example an id that was encoded as a specific point in time (via Last-Modified headers).
Or you could have a tailored stylesheet that gets cached by your browser and requests a unique resource, for example a background image with a name that encodes a unique id. As long as that image doesn't get cached (it may be sent with the caching headers set accordingly), your browser will keep requesting it whenever it encounters a page that uses the cached stylesheet...