Provenance.agent is a repeating field and so %resource.agent.who.resolve() is potentially a collection with multiple items. but the is operator only works over singletons.

From https://hl7.org/fhirpath/#is-type-specifier

> If the input collections contains more than one item, the evaluator will throw an error.

Aside:  I thought that it would fail when it gets to resolve() but that one actually does work over a non-singleton collection (per the definition at https://hl7.org/fhir/fhirpath.html#functions )