envoyd should be part of the cgroup

Putting each agent manually into the cgroup is needlessly inefficient
and also racy.