Vault × lambda-microvm fail-fast is obsolete after #854 — remove it and budget the pair instead

`AgentStack` refuses `enableLinearIdentityVault` together with `compute_type=lambda-microvm`. That guard was correct when it was written and is not any more: #854 reclaimed 30 resources, so the combination now fits comfortably under the quota. The guard therefore rejects a deployable configuration, and its error message quotes a resource count that is no longer true.

## Current behaviour

`cdk/src/stacks/agent.ts:373`:

```ts
if (linearIdentityVaultEnabled && computeType === 'lambda-microvm') {
throw new Error(
'enableLinearIdentityVault cannot be combined with '
+ 'compute_type=lambda-microvm: the two together exceed '
+ "CloudFormation's 500-resource limit for this stack (505). ...",
);
}
```

It exists so the operator gets both flag names instead of CDK's `TooManyResourcesInStack` per-type census, which gives no hint that two context flags are the cause. That reasoning still holds — only the arithmetic has changed.

## Measured

Synthesized counts (`Template.fromStack` + 1 for `AWS::CDK::Metadata`), hard quota 500:

| configuration | before #854 | now |
|---|---:|---:|
| vault + MicroVM | 505 — refused | 476 |
| vault + MicroVM + tool gateway | — | 483 |

Both are inside the 490 budget that #854 introduced.

## Why no test caught this

The covering test asserts the throw, at `cdk/test/stacks/agent.test.ts:1745`:

```ts
)).toThrow(
/enableLinearIdentityVault cannot be combined with .../
);
```

It passes for exactly as long as the guard exists, so it pins the guard rather than the headroom. It could not have gone red when the room appeared. A guard whose covering test cannot observe the condition it guards is the general shape worth avoiding here.

## Proposed change

1. Delete the guard and the `toThrow` test.
2. Add `enableLinearIdentityVault` as a dimension to the resource-budget matrix introduced by #854 in `cdk/test/stacks/agent.test.ts`, so vault × `compute_type` × tool-gateway is measured against the budget. That is the difference between permitting the combination and guarding it, and it is what would have caught this drift.
3. Drop the corresponding bullet from #831's limitations section.

## Notes

The guard is on the #831 branch (`feat/809-linear-identity-vault-pr`), not on `main`, so this is a follow-up rather than a defect in a released path — it should land after #831 merges, or be folded into it.

The counts above are from synth, not a live MicroVM deploy. Worth a live deploy on the MicroVM substrate before removing the guard, since the whole point of removing it is to make that path reachable.

Read cdk/src/stacks/agent.ts around line 373 and cdk/test/stacks/agent.test.ts around line 1745, then inspect the resource-budget matrix introduced by #854. Done means the obsolete guard and throw assertion are removed, vault is covered across compute type and tool-gateway combinations within the budget, the #831 limitations bullet is dropped, and a live MicroVM deploy is considered.

Written by the indexing model from the issue text.