Let's make use of the new DelegateSubgroup= feature and delegate the /supervisor/ subcgroup already to nspawn, so that moving the supervisor process there is unnecessary.