Vault × lambda-microvm fail-fast is obsolete after #854 — remove it and budget the pair instead

`AgentStack` refuses `enableLinearIdentityVault` together with `compute_type=lambda-microvm`. That guard was correct when it was written and is not any more: #854 reclaimed 30 resources, so the combination now fits comfortably under the quota. The guard therefore rejects a deployable configuration, and its error message quotes a resource count that is no longer true.

## Current behaviour

`cdk/src/stacks/agent.ts:373`:

```ts
if (linearIdentityVaultEnabled && computeType === 'lambda-microvm') {
throw new Error(
'enableLinearIdentityVault cannot be combined with '
+ 'compute_type=lambda-microvm: the two together exceed '
+ "CloudFormation's 500-resource limit for this stack (505). ...",
);
}
```

It exists so the operator gets both flag names instead of CDK's `TooManyResourcesInStack` per-type census, which gives no hint that two context flags are the cause. That reasoning still holds — only the arithmetic has changed.

## Measured

Synthesized counts (`Template.fromStack` + 1 for `AWS::CDK::Metadata`), hard quota 500:

| configuration | before #854 | now |
|---|---:|---:|
| vault + MicroVM | 505 — refused | 476 |
| vault + MicroVM + tool gateway | — | 483 |

Both are inside the 490 budget that #854 introduced.

## Why no test caught this

The covering test asserts the throw, at `cdk/test/stacks/agent.test.ts:1745`:

```ts
)).toThrow(
/enableLinearIdentityVault cannot be combined with .../
);
```

It passes for exactly as long as the guard exists, so it pins the guard rather than the headroom. It could not have gone red when the room appeared. A guard whose covering test cannot observe the condition it guards is the general shape worth avoiding here.

## Proposed change

1. Delete the guard and the `toThrow` test.
2. Add `enableLinearIdentityVault` as a dimension to the resource-budget matrix introduced by #854 in `cdk/test/stacks/agent.test.ts`, so vault × `compute_type` × tool-gateway is measured against the budget. That is the difference between permitting the combination and guarding it, and it is what would have caught this drift.
3. Drop the corresponding bullet from #831's limitations section.

## Notes

The guard is on the #831 branch (`feat/809-linear-identity-vault-pr`), not on `main`, so this is a follow-up rather than a defect in a released path — it should land after #831 merges, or be folded into it.

The counts above are from synth, not a live MicroVM deploy. Worth a live deploy on the MicroVM substrate before removing the guard, since the whole point of removing it is to make that path reachable.

Leggi cdk/src/stacks/agent.ts intorno alla riga 373 e cdk/test/stacks/agent.test.ts intorno alla riga 1745, quindi esamina la matrice del budget delle risorse introdotta da #854. Il lavoro è completato quando il guard obsoleto e l’asserzione di throw sono stati rimossi, vault è coperto entro il budget per le combinazioni di tipo di calcolo e tool-gateway, il punto sulle limitazioni di #831 è stato eliminato e viene preso in considerazione un deploy live di MicroVM.

Scritto dal modello di indicizzazione a partire dal testo della issue.