[Bug]: Agent systemd scopes lack cgroup Delegate — rootless kind/Podman fails inside agent sessions #21730

What happened

Linux agent processes launched via systemd-run --user --scope under app-t3code-agents*.slice only receive the memory and pids cgroup controllers. Nested rootless containers (kind with KIND_EXPERIMENTAL_PROVIDER=podman, Docker rootless, etc.) need cpu, cpuset, and io as well, and fail with errors like:

ERROR: failed to create cluster: running kind with rootless provider requires systemd Delegate=yes

The same workloads succeed outside a T3 agent session (e.g. a normal terminal, or a Cursor agent scope that already has full controllers).

Diagnosis

Comparing /sys/fs/cgroup/.../cgroup.controllers for a live agent scope showed only memory pids, while sibling user scopes (Cursor) had cpu cpuset io memory pids.

Agent scopes are created in apps/server/src/process/agentScope.ts without a valid systemd Delegate= assignment. An earlier attempt that used DelegateControllers= is rejected by systemd-run (Unknown assignment), so probes fall back to non-delegated options. systemd enables delegated controllers on ancestor slices when a scope starts with Delegate=; Delegate= cannot be set on slice units via systemctl set-property.

This is a regression versus earlier alphas that did not isolate agents in these scopes.

Steps to reproduce

1. On Linux with cgroup v2 and a rootless container runtime (Podman or Docker rootless).
2. Start a T3 Code agent session on a project that uses kind (e.g. KIND_EXPERIMENTAL_PROVIDER=podman make deploy).
3. Observe kind fail with a Delegate / cgroup setup error.
4. Run the same command in a normal user shell (outside the agent scope) — it succeeds when the host is otherwise configured for rootless kind.

Expected: agent sessions can run nested cgroup workloads the same way a normal user shell can.

Actual: agent scopes lack Delegate, so nested rootless containers cannot set up their cgroups.

Environment

• Linux (Fedora, cgroup v2), T3 Code desktop/server
• Rootless Podman + kind (KIND_EXPERIMENTAL_PROVIDER=podman)

Fix / related PR

Proposed fix: pass --property=Delegate=cpu cpuset io memory pids on agent scope units (with probe fallback). systemd enables those controllers on ancestors when the scope starts.

PR: #21700

Workaround

User drop-ins under ~/.config/systemd/user/ for t3code-.scope.d (and related) with Delegate=yes can unblock locally until the fix lands; prefer the PR once merged.