[State Sync Redesign 2.1] Migrate MetaMetrics to direct messenger subscriptions

`handleMetaMaskStateUpdate` currently receives full flat state via `this.on('update')`. It reads user traits from ~10 controllers (Preferences, Network, Tokens, NFTs, etc.). Replace with specific controller subscriptions.

## Steps

1. Identify which controller properties `_buildUserTraitsObject` reads
2. Subscribe to each relevant controller via messenger
3. Build traits from per-controller state instead of flat state
4. Remove `this.on('update', handleMetaMaskStateUpdate)` listener

## Files

- `app/scripts/metamask-controller.js`

## Risk

Low — traits are additive, missing one is non-fatal. Validate via MetaMetrics dashboard.

## Dependencies

Epic 1 Issue 1.3 (messenger subscriptions replace memStore path)

## Context

Part of [State Sync Redesign — Epic 2: Background cleanup].

Start in app/scripts/metamask-controller.js at handleMetaMaskStateUpdate and _buildUserTraitsObject. Identify the controller properties used, then trace the messenger subscription patterns from the State Sync Redesign context. Done means traits are built from relevant per-controller state, the update listener is removed, and MetaMetrics behavior is validated.

Written by the indexing model from the issue text.