Pin and verify the Linear runtime supply chain

[emmepra]

Outcome

Pins and verifies the approved Linear mcp-remote runtime supply chain in a dedicated, reproducible child slice for #29.

Changes

• Adds an exact npm manifest and complete lockfile for mcp-remote@0.1.38.
• Forces undici@7.29.0 and records registry URL/SHA-512 integrity for the complete production tree.
• Adds a fail-closed verifier for manifest, lock resolution, integrity, CycloneDX SBOM, and npm audit evidence.
• Adds focused positive and mutation tests, including missing-evidence rejection.

Scope boundary

This PR does not change OAuth, browser behavior, config lifecycle, identity/catalog handling, CI/security settings, docs, live runtime, or the candidate mega-worktree.

Verification

• Focused tests: 13/13 passed.
• Isolated npm ci --ignore-scripts --omit=dev: passed; lock remained byte-identical.
• npm audit --omit=dev --audit-level=high: zero vulnerabilities.
• CycloneDX 1.5: 81 components and 82 dependency nodes; graph/hash coherence verified.
• Independent Validator: PASS.
• Scope, secret, prohibited-surface, whitespace, and diff checks: passed.

Closes #29