fix(cdk): agent stack template at 98.4% of the CloudFormation 1 MB limit

### Observed (live deploy, 2026-08-06, ADR-021 P2 smoke run)

With the Lambda MicroVMs backend + image configured, the synthesized `backgroundagent-dev` template measured **983,796 bytes of the 1,000,000-byte CloudFormation limit (98.4%)** and **486 of 500 resources**. Roughly one more construct of headroom before deploys start failing for reasons unrelated to whatever change triggers it.

### Impact

Any feature adding a handful of resources (P3 suspend/resume wiring is next in line) can push the stack over either limit, failing deploys with confusing errors.

### Proposal

- Short term: measure per-construct contribution (`cdk synth | wc -c` bisection) and prune obvious weight (duplicated policy statements, verbose metadata)
- Structural: split the stack (nested stacks or a second stack for optional backends), which also helps the 500-resource ceiling
- Add a synth-time size/resource-count warning at e.g. 90% so the next increment is caught at build time, not deploy time

Found during ADR-021 P2 verification (#645); not MicroVM-specific.

Start with the CDK synthesis entry point and run `cdk synth` for the `backgroundagent-dev` template, measuring its byte size and resource count against the stated limits. Review the per-construct contributions and the proposed stack-splitting and warning approaches; done means the template has safe headroom or is split, and threshold warnings catch future growth before deployment.

Written by the indexing model from the issue text.