fix(supervisor): close adapter subscription and log-filter gaps

[mfw78]

What

Extends the chain-log fail-closed gate from #65 to the two remaining escape paths: adapter [[subscriptions]] entries and chain-log filter values.

load_provider now reads the adapter manifest's subscriptions and refuses boot on a chain not present in engine_cfg.chains, matching the module-side check.

Chain-log filter address and event_signature values are validated at load time and refuse boot on a parse failure, instead of being warn-skipped when the collection-time subscription list is rebuilt.

The boot_single manifest role now comes from the Role table (promoted to its own supervisor::role module) instead of a name-based fallback, and the provider/module load loops and telemetry helpers are folded to share that role-keyed path.

Why

Closes #80

The red-team on #65 found both gaps out of that PR's scope by design: adapter subscriptions never went through load_provider's chain check, and invalid filter values only warned at collection time rather than failing the boot that declared them. Both are the same fail-open family as #65 and belong on the same pre-compile, config-keyed gate.

Testing

cargo nextest run -p nexum-runtime supervisor::tests::chain_gate covering: boot_refuses_an_adapter_subscription_on_an_unconfigured_chain (adapter subscription past [chains] refuses before read component/compile), boot_refuses_an_invalid_chain_log_filter (bad address and bad topic each refuse boot with the offending detail in the message), and a_validated_chain_log_filter_survives_to_the_collected_subscription (a valid filter boots alive and the collected subscription's serialised filter carries the same address and topic).
unconfigured_chain_message_says_none_when_engine_toml_declares_no_chains updated for the new Role parameter on the shared refusal-message builder.

AI Assistance

Implementation by Claude Fable 5, red-team review by Claude Opus 5, PR by Claude Sonnet 5.