The jumpbox VM NIC gets deployed to the agent subnet:
(from main.bicep)
var varDeployJumpVm = deployToggles.?jumpVm ?? false
var varJumpVmMaintenanceConfigured = varDeployJumpVm && (jumpVmMaintenanceDefinition != null)
var varJumpSubnetId = empty(resourceIds.?virtualNetworkResourceId!)
? '${virtualNetworkResourceId}/subnets/agent-subnet'
: '${resourceIds.virtualNetworkResourceId!}/subnets/agent-subnet'