scenarios: provenance_supply_chain_linear — deep linear provenance chain (follow-up to #35)

Description

The pitch.

Follow-up #2 to #35 (closed as a duplicate of #31), the distinct-topology scenario @dhve flagged as worth landing independently.

## What
A new `provenance_supply_chain_linear` scenario — a deep **linear** dataset chain:

```
supplier-0 -> manufacturer-0 -> distributor-0 -> retailer-0 -> auditor-0
```

Each producer declares exactly the previous hop's dataset as its single provenance parent, so the lineage is one unbranched spine four hops deep. The auditor walks the whole chain back to the supplier's root, then runs the three attacks (substitution, forged freshness, broken provenance) as an outsider.

## Why it complements #31
#31's `provenance_supply_chain` is a **diamond** — it stresses lineage *fan-out* (a join whose ancestry forks back to a shared root). This one stresses lineage *depth* (a long single-parent chain). Notably #31's own history shows the scenario started linear and moved to a diamond; this restores the linear angle as a first-class, separate scenario rather than losing it.

## Minimal and #31-safe
- Exercises the **merged `cid_facts` plugin** as-is — no plugin changes.
- Emits the **same `|`-delimited provenance wire protocol** as the diamond, so it reuses #31's four validators under a new registry key `provenance_supply_chain_linear` — **zero new validator code**, and `provenance_supply_chain` is left completely untouched.
- Touch points: new scenario module + YAML, one `scenarios.py` dispatch branch, one `VALIDATORS` key, one line in the registry test.

## Adversarial discrimination (same YAML, two plugins)
```
uv run nest run scenarios/provenance_supply_chain_linear.yaml
# cid_facts  -> 4x PASS (chain resolved to depth 4)
# datafacts_v1 -> chain_integrity PASS, substitution/freshness/provenance FAIL
```

## Determinism & tests
Tier 1, seeded only, logical-tick clock. `test_provenance_supply_chain_linear.py` asserts all-pass on `cid_facts`, the three adversarial FAILs on `datafacts_v1`, lineage depth == 4, and **byte-identical replay under seeds 42 / 7 / 1337**.

## Verify
```
uv run ruff check . && uv run ruff format --check . && uv run pyright && uv run pytest -q
# 740 passed, 1 skipped
```

Persona — provenance-engineer: content addressing as substitution resistance, lineage folded into the content hash so a deep chain is tamper-evident end to end, freshness bound under a signature, and a verifier anchored to externally observed ticks.