fix(cdk): agent stack template at 98.4% of the CloudFormation 1 MB limit

[dreamorosi]

Observed (live deploy, 2026-08-06, ADR-021 P2 smoke run)

With the Lambda MicroVMs backend + image configured, the synthesized backgroundagent-dev template measured 983,796 bytes of the 1,000,000-byte CloudFormation limit (98.4%) and 486 of 500 resources. Roughly one more construct of headroom before deploys start failing for reasons unrelated to whatever change triggers it.

Impact

Any feature adding a handful of resources (P3 suspend/resume wiring is next in line) can push the stack over either limit, failing deploys with confusing errors.

Proposal

• Short term: measure per-construct contribution (cdk synth | wc -c bisection) and prune obvious weight (duplicated policy statements, verbose metadata)
• Structural: split the stack (nested stacks or a second stack for optional backends), which also helps the 500-resource ceiling
• Add a synth-time size/resource-count warning at e.g. 90% so the next increment is caught at build time, not deploy time

Found during ADR-021 P2 verification (#645); not MicroVM-specific.

[krokoko]

The template-size remediation is included in #912, pending review and merge.

All parent and nested templates now use compact JSON. The normal build enforces a shared 800,000-byte budget across 90 deployment profiles, including configured MicroVM images, Gateway, Registry, the Linear vault, and both network topologies. It also fails on CDK template-size warnings.

The managed-Blueprint offline census measured a maximum application template of 709,799 bytes with inline networking and 655,784 bytes with split networking. All 90 profiles synthesized twice without differences; the final repository build passed real bundled synthesis and the full profile guard suite.

#912 includes the measurements, reproduction command through the census task, and validation limitations, and will close this issue on merge.