(besides fingerprinting which is not considered here)
I don't think it's very helpful to distinguish fingerprinting from tracking.
Is it correct that (third-party) cookies and ETags provide the only way to track users across domains
No.
All tracking methods work by assigning a unique ID to you and making sure that you (or your browser) send that ID back when you visit a domain.
You're assuming that only cookies and ETags get sent back automatically (thanks to the HTTP protocol), but a website can pretty much run any code it wants on your computer by embedding Javascript.
Whether the javascript code calculates a browser fingerprint or phones home a tracking ID doesn't really matter. Javascript has to jump through some hoops because of cross domain attack prevention schemes such same origin policies, but thanks to CORS, if the domains in question cooperate, javascript will happily follow along. This isn't really a limitation to tracking compared to the cookie method because in order for cookie cross-domain tracking to work, the domains in question must also cooperate (e.g. embed a doubleclick resource).
Leaving javascript out of the picture, ETags and Cookies aren't the only cross-domain tracking possibilities by far.
For example, you could also use the other cache control HTTP headers to send unique ids, for example an id that was encoded as a specific point in time (via Last-Modified headers).
Or you could have a tailored stylesheet that gets cached by your browser and requests a unique resource, for example a background image with a name that encodes a unique id. As long as that image doesn't get cached (it may be sent with the caching headers set accordingly), your browser will keep requesting it whenever it encounters a page that uses the cached stylesheet...