Vault × lambda-microvm fail-fast is obsolete after #854 — remove it and budget the pair instead

`AgentStack` refuses `enableLinearIdentityVault` together with `compute_type=lambda-microvm`. That guard was correct when it was written and is not any more: #854 reclaimed 30 resources, so the combination now fits comfortably under the quota. The guard therefore rejects a deployable configuration, and its error message quotes a resource count that is no longer true.

## Current behaviour

`cdk/src/stacks/agent.ts:373`:

```ts
if (linearIdentityVaultEnabled && computeType === 'lambda-microvm') {
throw new Error(
'enableLinearIdentityVault cannot be combined with '
+ 'compute_type=lambda-microvm: the two together exceed '
+ "CloudFormation's 500-resource limit for this stack (505). ...",
);
}
```

It exists so the operator gets both flag names instead of CDK's `TooManyResourcesInStack` per-type census, which gives no hint that two context flags are the cause. That reasoning still holds — only the arithmetic has changed.

## Measured

Synthesized counts (`Template.fromStack` + 1 for `AWS::CDK::Metadata`), hard quota 500:

| configuration | before #854 | now |
|---|---:|---:|
| vault + MicroVM | 505 — refused | 476 |
| vault + MicroVM + tool gateway | — | 483 |

Both are inside the 490 budget that #854 introduced.

## Why no test caught this

The covering test asserts the throw, at `cdk/test/stacks/agent.test.ts:1745`:

```ts
)).toThrow(
/enableLinearIdentityVault cannot be combined with .../
);
```

It passes for exactly as long as the guard exists, so it pins the guard rather than the headroom. It could not have gone red when the room appeared. A guard whose covering test cannot observe the condition it guards is the general shape worth avoiding here.

## Proposed change

1. Delete the guard and the `toThrow` test.
2. Add `enableLinearIdentityVault` as a dimension to the resource-budget matrix introduced by #854 in `cdk/test/stacks/agent.test.ts`, so vault × `compute_type` × tool-gateway is measured against the budget. That is the difference between permitting the combination and guarding it, and it is what would have caught this drift.
3. Drop the corresponding bullet from #831's limitations section.

## Notes

The guard is on the #831 branch (`feat/809-linear-identity-vault-pr`), not on `main`, so this is a follow-up rather than a defect in a released path — it should land after #831 merges, or be folded into it.

The counts above are from synth, not a live MicroVM deploy. Worth a live deploy on the MicroVM substrate before removing the guard, since the whole point of removing it is to make that path reachable.

Lies cdk/src/stacks/agent.ts um Zeile 373 und cdk/test/stacks/agent.test.ts um Zeile 1745 und untersuche anschließend die durch #854 eingeführte Resource-Budget-Matrix. Als erledigt gilt, wenn der veraltete Guard und die Throw-Assertion entfernt wurden, vault innerhalb des Budgets über Kombinationen aus Compute-Typ und tool-gateway abgedeckt ist, der Aufzählungspunkt zu den Einschränkungen von #831 entfernt wurde und ein Live-MicroVM-Deployment in Betracht gezogen wird.

Vom Indexierungsmodell aus dem Issue-Text verfasst.