Resolution
If you are using the controlled agent functionality to restrict only trusted jobs to a specific agent then you need to assign a unique label to that agent and set the agent to only run jobs specific to that label.
If you do not make that change then Jenkins' node provisioning (which cannot have any awareness of the controlled agent restriction) will just see that there are executors available and not provision nodes.
The purpose of the controlled agents functionality is to provide a last shot restriction on agents so that a user cannot just configure a job to run on the controlled agent by knowing the label, they must also have got approval, but the restriction presupposes that you have tied the jobs to the agent using labelling restrictions.