subagent: keep runs at +1000 when their cgroup is unavailable

Without a run cgroup (no delegation, setup failed, or one create
failed) a subagent run was started plain at oom_score_adj 0, below the
+500 the unit gave it before. Every run of the daemon now goes through
the entry wrapper; it sets +1000 and enters the cgroup only when there
is one. run_cgroup::entry takes the cgroup as an Option.

hive-subagent-mcp/tests/run_entry.rs

@@ -26,3 +26,16 @@ fn the_entry_enters_the_cgroup_raises_the_score_and_execs_the_program() {
     assert_eq!(String::from_utf8_lossy(&out.stdout), "1000|unset|an-arg");
     assert_eq!(procs.expect("cgroup.procs written"), "0");
 }
+
+#[test]
+fn the_entry_without_a_cgroup_still_raises_the_score() {
+    let out = Command::new(env!("CARGO_BIN_EXE_hive-subagent-daemon"))
+        .env("HIVE_RUN_ENTRY_PROGRAM", "/bin/sh")
+        .env_remove("HIVE_RUN_ENTRY_CGROUP")
+        .env("HIVE_RUN_ENTRY_OOM_SCORE_ADJ", "1000")
+        .args(["-c", "cat /proc/self/oom_score_adj"])
+        .output()
+        .expect("the binary runs");
+    assert!(out.status.success(), "{out:?}");
+    assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "1000");
+}