supervisor: provider subscriptions and chain-log filter values escape boot validation

[mfw78]

The red-team on #65 (PR #75) confirmed two remaining fail-open paths in the same family, out of #65's scope by design:

• Provider/adapter [[subscription]] entries naming a chain are still ungated: load_provider never reads manifest.subscriptions, so an adapter manifest can name any chain_id with no boot check.
• Invalid chain-log address/event_signature filter values are still warn-skipped at collection time instead of failing boot.

Both should land as one fail-closed validation slice mirroring the module-side gate #65 added (pre-compile, config-keyed against engine_cfg.chains).