fix(cdk): agent stack template at 98.4% of the CloudFormation 1 MB limit

### Observed (live deploy, 2026-08-06, ADR-021 P2 smoke run)

With the Lambda MicroVMs backend + image configured, the synthesized `backgroundagent-dev` template measured **983,796 bytes of the 1,000,000-byte CloudFormation limit (98.4%)** and **486 of 500 resources**. Roughly one more construct of headroom before deploys start failing for reasons unrelated to whatever change triggers it.

### Impact

Any feature adding a handful of resources (P3 suspend/resume wiring is next in line) can push the stack over either limit, failing deploys with confusing errors.

### Proposal

- Short term: measure per-construct contribution (`cdk synth | wc -c` bisection) and prune obvious weight (duplicated policy statements, verbose metadata)
- Structural: split the stack (nested stacks or a second stack for optional backends), which also helps the 500-resource ceiling
- Add a synth-time size/resource-count warning at e.g. 90% so the next increment is caught at build time, not deploy time

Found during ADR-021 P2 verification (#645); not MicroVM-specific.

Comienza con el punto de entrada de síntesis de CDK y ejecuta `cdk synth` para el template `backgroundagent-dev`, midiendo su tamaño en bytes y el número de recursos con respecto a los límites indicados. Revisa las contribuciones de cada construct y los enfoques propuestos para dividir el stack y generar advertencias; se considera terminado cuando el template tiene un margen de seguridad suficiente o está dividido, y las advertencias de umbral detectan el crecimiento futuro antes del despliegue.

Escrito por el modelo de indexación a partir del texto del issue.